High 8.3Published Jun 24, 2026

CVE-2026-52920netfilter: xt_policy: fix strict mode inbound policy matching

Updated under an hour ago (Oct 28, 2026, 6:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout. Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.

CVSS: 8.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Weakness (CWE): CWE-682
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before eb323f7b82d2e2f638de0cc2a177803eb20e0707; from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before fc1c518bb1f054831ecabb32da9b8e1dff9699c6; from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before f98b7f85e04b40e28b08c461ded0cc79f14f5509; from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before 82664d0f1ba25e4f9a71994954abae24c60f4067; from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9; from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before 938867e870fb5471bb16f442aeac81326e05bf65; from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before 392cc1d8408b5665215c1e9290bbf0f92339b043; from c4b885139203d37f76662c37ae645fe8e0f4e4e5 before 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.17 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10; 7.1	NVD

References

References

https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707	patch
https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6	patch
https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509	patch
https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067	patch
https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9	patch
https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65	patch
https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043	patch
https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.