Medium 5.5Published Jun 24, 2026

CVE-2026-52921netfilter: ipset: stop hash:* range iteration at end

Updated under an hour ago (Oct 28, 2026, 5:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: stop hash:* range iteration at end The following hash set variants: hash:ip,mark hash:ip,port hash:ip,port,ip hash:ip,port,net iterate IPv4 ranges with a 32-bit iterator. The iterator must stop once the last address in the requested range has been processed. Advancing it once more can move the traversal state past the end of the request, so a later retry may continue from an unintended position. Handle the iterator increment explicitly at the end of the loop and stop once the upper bound has been processed. This keeps the existing retry behaviour intact for valid ranges while preventing traversal from continuing past the original boundary.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc before be75218fadea22e59c8673db212f29c681bf45bb; from 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc before 383418c20e69f5761b6ec5238f599423f4fb77fb; 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc builds before 0d7b33ace701fe397e6e4de145f32e098178d901; from 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc before c281e018af98df91827d65bec00f4956c00a1b02; 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc builds before 02f75f041a93ea045834da89cd3234f4c1d749b4; 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc builds before 952e988163c2ab9939c3db9f0f8e77af6a1bb436; 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc builds before 0b530efb2cc9dbdddfd49d392e3a857f0d4ce8dc; 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc builds before 0d3a282ab5f165fc207ff49ea5b6ad8f54616bd6	CNA record
linux linux_kernel linux:linux_kernel	from 4.14.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 4.14; and 8 more ranges	NVD

References

References

https://git.kernel.org/stable/c/be75218fadea22e59c8673db212f29c681bf45bb	patch
https://git.kernel.org/stable/c/383418c20e69f5761b6ec5238f599423f4fb77fb	patch
https://git.kernel.org/stable/c/0d7b33ace701fe397e6e4de145f32e098178d901	patch
https://git.kernel.org/stable/c/c281e018af98df91827d65bec00f4956c00a1b02	patch
https://git.kernel.org/stable/c/02f75f041a93ea045834da89cd3234f4c1d749b4	patch
https://git.kernel.org/stable/c/952e988163c2ab9939c3db9f0f8e77af6a1bb436	patch
https://git.kernel.org/stable/c/0b530efb2cc9dbdddfd49d392e3a857f0d4ce8dc	patch
https://git.kernel.org/stable/c/0d3a282ab5f165fc207ff49ea5b6ad8f54616bd6	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.