CVE-2026-64006

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: fix dst corruption in same register operation<br /> <br /> For lshift and rshift, the shift operations are performed in a loop over<br /> 32-bit words. The loop calculates the shifted value and write it to dst,<br /> and then immediately reads from src to calculate the carry for the next<br /> iteration. Because src and dst could point to the same memory location,<br /> the carry is incorrectly calculated using the newly modified dst value<br /> instead of the original src value.<br /> <br /> Adding a temporary local variable to cache the original value before<br /> writing to dst and using it for the carry calculation solves the<br /> problem. In addition, partial overlap is rejected from control plane for<br /> all kind of operations including byteorder. This was tested with the<br /> following bytecode:<br /> <br /> table test_table ip flags 0 use 1 handle 1<br /> ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1<br /> ip test_table test_chain 2<br /> [ immediate reg 1 0x44332211 0x88776655 ]<br /> [ bitwise reg 1 = ( reg 1