CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_payload: fix mask build for partial field offload

nft_payload_offload_mask() builds the offload match mask for a payload
expression that covers only part of a header field.  For a partial IPv6
address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which
is undefined on the 32-bit int operand.  It also trims only one word, so
the remaining words stay 0xffffffff (and when priv_len is a multiple of 4
the trim is skipped entirely), leaving the mask covering more bytes than
the rule matches.

  UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20
  shift exponent 120 is too large for 32-bit type 'int'
  ...

The match is byte-granular and struct nft_data is zero-initialised, so the
correct mask is simply the first priv_len bytes set to 0xff. Set those
bytes directly and drop the word/shift trimming; this removes the undefined
shift and no longer over-masks the trailing bytes.

The Linux kernel CVE team has assigned CVE-2026-74579 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10 with commit a5d45bc0dc50f9dd83703510e9804d813a9cac32 and fixed in 6.6.151 with commit b19b5d2e042c294e2cc1c908dc598f9d64015396
	Issue introduced in 5.10 with commit a5d45bc0dc50f9dd83703510e9804d813a9cac32 and fixed in 6.12.103 with commit a375d8ace807767f29f276b681b6324c74929b1d
	Issue introduced in 5.10 with commit a5d45bc0dc50f9dd83703510e9804d813a9cac32 and fixed in 6.18.44 with commit 16b553c46e347bc9de9946c4960654d5884a86de
	Issue introduced in 5.10 with commit a5d45bc0dc50f9dd83703510e9804d813a9cac32 and fixed in 7.1.8 with commit 630295d5bba1d0e0f494cc459452eb0a0058c545
	Issue introduced in 5.10 with commit a5d45bc0dc50f9dd83703510e9804d813a9cac32 and fixed in 7.2 with commit 39e88f28fb32bf02bd4b525c24c842c9cff5663d
	Issue introduced in 5.9.14 with commit 5c2b4b4f9fa5b765b927e361e3d310bcb5773015

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74579
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nft_payload.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396
	https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d
	https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de
	https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545
	https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d