CVE-2026-45873 Overview
CVE-2026-45873 is a Linux kernel vulnerability in the netfilter subsystem, specifically within the nft_set_rbtree implementation. The flaw involves incomplete overlap detection logic for anonymous sets used by nftables. Userspace can provide an optimized interval representation in which the end element is omitted when intervals are adjacent. The existing partial overlap detection skipped checks on start elements for this reason, allowing overlapping intervals such as A-B and A-C (where C < B) to be accepted without rejection. Maintainers resolved the issue by restoring the check on overlapping start elements so the kernel reports an overlap.
Critical Impact
Overlapping interval entries in anonymous nftables sets could be accepted without error, producing inconsistent firewall set state and unpredictable packet classification.
Affected Products
- Linux kernel (netfilter nft_set_rbtree subsystem)
- Distributions shipping affected upstream stable kernel branches prior to the referenced fix commits
- Systems using nftables with anonymous interval sets
Discovery Timeline
- 2026-05-27 - CVE-2026-45873 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45873
Vulnerability Analysis
The vulnerability resides in the nft_set_rbtree backend, which implements set storage using a red-black tree for nftables. Anonymous sets support an optimized format where adjacent intervals omit the explicit end element. To accommodate this format, the partial overlap detection routine intentionally bypassed checks on start elements. That shortcut allowed two intervals sharing the same start value but different end values to coexist in the tree without triggering an overlap error.
For example, inserting A-B followed by A-C (where C < B) produced an inconsistent set state because both entries were accepted. The corrupted state can affect packet matching decisions in firewall rules that rely on the set, leading to unpredictable classification behavior. The fix restores the overlap check on start elements so the kernel correctly returns an error and refuses to insert the conflicting interval.
Root Cause
The root cause is an input validation gap in the rbtree set backend [Improper Input Validation]. The optimization that omitted end elements for adjacent intervals also caused the validator to skip start-element overlap checks. This left a logic path where two start elements sharing the same key could be inserted into the same anonymous set.
Attack Vector
A local user with CAP_NET_ADMIN (typically root or a privileged namespace) can exercise the flaw by submitting crafted nftables set definitions through the Netlink interface. The vulnerability is not remotely reachable. Exploitation requires the ability to create and populate nftables anonymous sets. The result is data inconsistency in the firewall set rather than direct memory corruption.
No verified proof-of-concept code is published. Refer to the upstream commits for the precise code-level changes that close the validation gap.
Detection Methods for CVE-2026-45873
Indicators of Compromise
- Anonymous nftables sets containing multiple interval entries sharing identical start elements with differing end elements
- Unexpected packet classification outcomes that deviate from declared nftables rules
- Userspace nft tool dumps showing overlapping intervals that should have been rejected at insertion
Detection Strategies
- Audit kernel version strings across Linux fleets against the fixed commits referenced in upstream stable trees
- Inspect loaded nftables rulesets using nft list ruleset and validate interval consistency on hosts running pre-patch kernels
- Correlate firewall behavior anomalies with the presence of anonymous interval sets in netfilter configurations
Monitoring Recommendations
- Track kernel package update status across Linux endpoints and servers using configuration management telemetry
- Monitor for processes invoking nft, iptables-nft, or Netlink NFNL_SUBSYS_NFTABLES operations from non-administrative contexts
- Alert on unexpected modifications to running nftables rulesets on production hosts
How to Mitigate CVE-2026-45873
Immediate Actions Required
- Update the Linux kernel to a version that includes the upstream fix commits referenced below
- Restart affected systems after patching to ensure the new kernel is loaded
- Review any automated tooling that programmatically creates anonymous nftables sets for unintended overlapping intervals
Patch Information
The issue is resolved across multiple stable branches via the following upstream commits: Kernel Commit 029e5f6, Kernel Commit 05feaf8, Kernel Commit 4780ec1, Kernel Commit 7ca5813, Kernel Commit dad14d2, Kernel Commit e6497e0, Kernel Commit f1381ce, and Kernel Commit f1535d5. Apply the kernel update provided by your distribution that incorporates these changes.
Workarounds
- Restrict CAP_NET_ADMIN to trusted administrative users and avoid granting it to unprivileged containers or user namespaces
- Validate nftables rulesets at build time using nft -c -f ruleset.nft and reject configurations that depend on overlapping interval semantics
- Where feasible, replace anonymous interval sets with named sets that allow explicit lifecycle management and review
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
