{"id":"CVE-2026-99285","published":"2026-11-10T18:17:49.147","lastModified":"2026-11-10T18:17:49.147","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_byteorder: remove multi-register support\n\n64bit byteorder conversion is broken when several registers need to be\nconverted because the source register array advances in steps for 4 bytes\ninstead of 8:\n\n  for (i = ...\n      src64 = nft_reg_load64(&src[i]);\n                             ~~~~~ u32 *src\n      nft_reg_store64(&dst64[i],\n\nRemove the multi-register support, it has other issues as well:\n\nPablo points out that commit\ncaf3ef7468f7 (\"netfilter: nf_tables: prevent OOB access in nft_byteorder_eval\")\nalters semantics: before the loop operated on registers, i.e.\n for ( ... )\n   dst32[i] = htons((u16)src32[i])\n\n .. but after the patch it will operate on bytes, which makes this\n useless to convert e.g. concatenations, which store each compound\n in its own register.\n\nMulti-convert of u32 has one theoretical application:\n\nct mark . meta mark . tcp dport @intervalset\n\nBecause ct mark and meta mark are host byte order, use with\nintervals has to convert the byteorder for ct/meta mark value\nto network byte order (bigendian).\n\nnftables emits this:\n [ meta load mark => reg 1 ]\n [ byteorder reg 1 = hton(reg 1, 4, 4) ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 9 = hton(reg 9, 4, 4) ]\n ...\n\nI.e. two separate calls.  Theoretically it could be changed to do:\n [ meta load mark => reg 1 ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 1 = htonl(reg 1, 4, 8) ]\n ...\n\nBut then all it would take to change the set to\nmeta mark . tcp dport . ct mark\n\n... and we'd be back to two \"byteorder\" calls. IOW, support to\nconvert a range of registers is both dysfunctional and dubious.\n\nSimplify this: remove the feature.\n\nPablo Neira Ayuso points out that nftables before 1.1.0 can generate\nincorrect byteorder conversions, see 9fe58952c45a,\n\"evaluate: skip byteorder conversion for selector smaller than 2 bytes\"\nin nftables.git).  Affected rulesets fail to load with this change and\nold userspace due to 'len != size' check.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/3c5fb3a6c8118d15e60295e76fb5b879021eef43","tags":[]},{"url":"https://git.kernel.org/stable/c/bb061d3de41707415269be75ebf700efb03ec212","tags":[]},{"url":"https://git.kernel.org/stable/c/dc29c0478b8564feb9371e715b5a0016eb8903fd","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}