CVE-2026-52921

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ipset: stop hash:* range iteration at end<br /> <br /> The following hash set variants:<br /> <br /> hash:ip,mark<br /> hash:ip,port<br /> hash:ip,port,ip<br /> hash:ip,port,net<br /> <br /> iterate IPv4 ranges with a 32-bit iterator.<br /> <br /> The iterator must stop once the last address in the requested range has<br /> been processed. Advancing it once more can move the traversal state past<br /> the end of the request, so a later retry may continue from an unintended<br /> position.<br /> <br /> Handle the iterator increment explicitly at the end of the loop and stop<br /> once the upper bound has been processed. This keeps the existing retry<br /> behaviour intact for valid ranges while preventing traversal from<br /> continuing past the original boundary.