CVE-2026-46101: Linux Kernel Netfilter Shift Vulnerability

CVE-2026-46101 Overview

CVE-2026-46101 is a Linux kernel vulnerability in the netfilter subsystem, specifically in the nft_bitwise expression handler. The flaw allows a zero shift operand to be passed to nft_bitwise left and right shift expressions during initialization. The carry propagation logic computes the carry from the adjacent 32-bit word using BITS_PER_TYPE(u32) - shift, which becomes a 32-bit shift when the operand is zero. A 32-bit shift on a u32 value is undefined behavior in C, leading to unpredictable kernel behavior in the packet processing path.

Critical Impact
A malformed nftables rule can trigger undefined behavior in the kernel packet path, potentially causing unpredictable results in netfilter rule evaluation.

Affected Products

Linux kernel (netfilter subsystem)
nf_tables / nft_bitwise expression module
Linux distributions shipping affected kernel versions

Discovery Timeline

2026-05-27 - CVE-2026-46101 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46101

Vulnerability Analysis

The vulnerability resides in the nft_bitwise expression of the Linux kernel's nf_tables framework, which provides bitwise operations such as AND, OR, XOR, left shift, and right shift on packet metadata or register contents. During rule initialization, the control plane validates that shift operands are below 32 but fails to reject a shift operand of zero. The carry propagation logic for shift operations computes a complementary shift amount as BITS_PER_TYPE(u32) - shift. When the user-supplied shift value is zero, this calculation yields 32, and shifting a u32 value by 32 bits invokes undefined behavior under the C standard. The compiler is free to emit instructions whose results vary by architecture, optimization level, and surrounding code.

Root Cause

The root cause is an Input Validation Error in the control plane validation of nft_bitwise shift expressions. The existing range check only rejected values greater than or equal to 32, leaving zero as a valid but problematic operand. The carry propagation arithmetic assumed a nonzero shift, so the boundary case fell through to the packet processing path.

Attack Vector

Exploitation requires the ability to load nftables rules, which typically demands CAP_NET_ADMIN privileges within a network namespace. An attacker who can create user namespaces and configure netfilter rules can register a malformed bitwise shift expression with a zero shift operand. Once installed, the rule executes against passing packets and triggers undefined behavior in the kernel data path. The vulnerability does not include a published proof-of-concept exploit.

No verified exploitation code is publicly available. See the upstream kernel commits referenced in the Linux Kernel Commit for the corrective patch implementing the additional validation.

Detection Methods for CVE-2026-46101

Indicators of Compromise

Creation of nftables rules containing bitwise shift expressions with a shift operand of zero.
Kernel log entries referencing nft_bitwise initialization failures after applying the patched kernel.
Unprivileged processes spawning user namespaces and subsequently issuing nft or NFNL_SUBSYS_NFTABLES netlink messages.

Detection Strategies

Audit nft command-line invocations and direct netlink traffic on NFNETLINK_NFTABLES for rules defining bitwise expressions with shift operations.
Inspect loaded nftables rulesets across hosts using nft list ruleset and flag any >> or << operations with a zero operand.
Correlate user-namespace creation with CAP_NET_ADMIN acquisition and subsequent netfilter configuration changes by non-root users.

Monitoring Recommendations

Enable kernel auditing for netlink messages targeting the netfilter subsystem and forward to centralized logging.
Track kernel version compliance across the Linux fleet to confirm the patched stable release is deployed.
Alert on unexpected modifications to nftables rulesets outside of approved change windows or configuration management runs.

How to Mitigate CVE-2026-46101

Immediate Actions Required

Apply the upstream Linux kernel patch that rejects zero shift operands in nft_bitwise initialization.
Update to a stable kernel release containing one of the referenced fix commits and reboot affected hosts.
Restrict the ability to create user namespaces for untrusted local users to reduce the attack surface for netfilter rule manipulation.

Patch Information

The fix rejects zero shift operands in the control plane during nft_bitwise initialization, alongside the existing check for values greater than or equal to 32. This prevents malformed rules from reaching the packet processing path. The patch is available in the following stable tree commits: 6f820139d16a, bffef0acec9c, ca24f1243ad1, f370205974f1, and fe11e5c40817.

Workarounds

Disable unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where supported by the distribution.
Restrict loading of the nf_tables kernel module on systems that do not require it through module blacklisting.
Enforce mandatory access control policies (SELinux, AppArmor) that deny CAP_NET_ADMIN to non-administrative workloads.

bash

# Configuration example: disable unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/99-userns.conf

# Verify the running kernel after patching
uname -r