CVE-2026-52921 Overview
CVE-2026-52921 is a Linux kernel vulnerability in the netfilteripset subsystem. The flaw affects the hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net set variants when iterating IPv4 ranges with a 32-bit iterator. The iterator fails to stop after processing the final address in a requested range. Advancing it one step further moves the traversal state past the intended boundary, so a later retry can resume from an unintended position. Maintainers resolved the issue by handling the iterator increment explicitly at the end of the loop and halting once the upper bound has been processed.
Critical Impact
Incorrect range iteration in ipset hash set variants can cause traversal to continue past requested boundaries, leading to inconsistent set state on retry paths.
Affected Products
- Linux kernel netfilter subsystem
- ipset hash set variants: hash:ip,mark, hash:ip,port, hash:ip,port,ip, hash:ip,port,net
- Distributions shipping affected stable kernel branches prior to the linked fix commits
Discovery Timeline
- 2026-06-24 - CVE-2026-52921 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52921
Vulnerability Analysis
The netfilteripset framework supports set types that store combinations of IPv4 addresses with auxiliary keys such as marks, ports, and networks. When a user adds or removes a range, the kernel iterates the IPv4 portion using a 32-bit counter. The iteration must terminate once the last address in the requested range has been processed.
The original loop advanced the iterator after processing the upper bound. This extra increment shifted the traversal state past the requested end, so a subsequent retry continued from an address outside the original range. The defect is a boundary condition error [CWE-193 class] in kernel set bookkeeping rather than a memory safety bug.
Root Cause
The root cause is missing explicit termination logic at the upper bound of the iteration. The loop relied on implicit increment behavior that did not account for the inclusive nature of the requested range. The fix handles the increment explicitly at the end of the loop and stops once the upper bound has been processed, preserving retry semantics for valid ranges.
Attack Vector
Exploitation requires the ability to manipulate ipset entries, which is normally restricted to privileged users holding CAP_NET_ADMIN in the relevant namespace. Containerized workloads or unprivileged user namespaces that expose ipset management to lower-trust principals expand the attack surface. The flaw causes incorrect set contents on retry paths rather than direct memory corruption.
No verified public exploit code is available. See the upstream commits referenced below for the technical fix details: Kernel commit 02f75f04, Kernel commit c281e018, and Kernel commit be75218f.
Detection Methods for CVE-2026-52921
Indicators of Compromise
- Unexpected ipset entries outside the originally requested IPv4 ranges after retry operations
- Inconsistent firewall behavior where packets match or bypass rules tied to recently modified sets
- Audit log entries showing repeated ipset add or ipset del retries against the affected set variants
Detection Strategies
- Compare current kernel build identifiers against the fixed commits listed in the upstream references
- Inventory hosts running ipset with hash:ip,mark, hash:ip,port, hash:ip,port,ip, or hash:ip,port,net set types
- Review configuration management logs for ipset range operations and correlate them with anomalous set membership
Monitoring Recommendations
- Enable kernel audit rules for netlink operations targeting nfnetlink_subsys_ipset
- Track changes to ipset membership counts over time and alert on deltas that exceed requested range sizes
- Monitor for unprivileged user namespace creation patterns that can expose CAP_NET_ADMIN to lower-trust workloads
How to Mitigate CVE-2026-52921
Immediate Actions Required
- Apply the stable kernel updates referenced in the upstream commits to all affected hosts
- Identify workloads that rely on the affected ipset variants and schedule reboots after kernel package installation
- Restrict CAP_NET_ADMIN and unprivileged user namespace access where business requirements permit
Patch Information
The fix is distributed across multiple stable branches. Apply the kernel update that contains the corresponding commit for your branch: 02f75f04, 0b530efb, 0d3a282a, 0d7b33ac, 383418c2, 952e9881, be75218f, and c281e018.
Workarounds
- Avoid issuing large IPv4 range operations against the affected ipset variants until the kernel is patched
- Replace affected set types with equivalent hash:net or hash:ip constructs where feasible
- Constrain ipset administration to a single trusted control plane to reduce retry-driven inconsistencies
# Verify the running kernel and ipset module versions
uname -r
modinfo ip_set | grep -E '^(version|srcversion):'
# List set types currently in use to identify affected variants
ipset list -t | grep -E 'Type: hash:ip,(mark|port|port,ip|port,net)'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
