CVE-2026-52920 - Vulnerability Details

- netfilter: xt_policy: fix strict mode inbound policy matching

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_policy: fix strict mode inbound policy matching

match_policy_in() walks sec_path entries from the last transform to the
first one, but strict policy matching needs to consume info->pol[] in
the same forward order as the rule layout.

Derive the strict-match policy position from the number of transforms
already consumed so that multi-element inbound rules are matched
consistently.

Published: 2026-06-24

Score: 8.3 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< eb323f7b82d2e2f638de0cc2a177803eb20e0707
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< fc1c518bb1f054831ecabb32da9b8e1dff9699c6
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< f98b7f85e04b40e28b08c461ded0cc79f14f5509
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< 82664d0f1ba25e4f9a71994954abae24c60f4067
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< 938867e870fb5471bb16f442aeac81326e05bf65
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< 392cc1d8408b5665215c1e9290bbf0f92339b043
`c4b885139203d37f76662c37ae645fe8e0f4e4e5`	affected	< 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29

Linux

affected

Version	Status	Constraints
`2.6.17`	affected	—
`0`	unaffected	< 2.6.17
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,eb323f7b82d2e2f638de0cc2a177803eb20e0707)`	affected	code_commit	—
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,fc1c518bb1f054831ecabb32da9b8e1dff9699c6)`	affected	code_commit	—
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,f98b7f85e04b40e28b08c461ded0cc79f14f5509)`	affected	code_commit	—
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,82664d0f1ba25e4f9a71994954abae24c60f4067)`	affected	code_commit	—
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9)`	affected	code_commit	—
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,938867e870fb5471bb16f442aeac81326e05bf65)`	affected	code_commit	—
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,392cc1d8408b5665215c1e9290bbf0f92339b043)`	affected	code_commit	—
`[c4b885139203d37f76662c37ae645fe8e0f4e4e5,4b2b4d7d4e203c92db8966b163edfacb1f0e1e29)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.17`	affected	semver	—
`[0,2.6.17)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.141,6.7.0)`	unaffected	semver	—
`[6.12.91,6.13.0)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00299.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043
https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29
https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067
https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65
https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9
https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707
https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509
https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6
https://lore.kernel.org/linux-cve-announce/2026062430-CVE-2026-52920-22f8@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52920
https://www.cve.org/CVERecord?id=CVE-2026-52920

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'}`

Thu, 25 Jun 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-285

Thu, 25 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-551
References		https://lore.kernel.org/linux-cve-announce/2026062430-CVE-2026-52920-22f8@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52920 https://www.cve.org/CVERecord?id=CVE-2026-52920
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 24 Jun 2026 14:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-285

Wed, 24 Jun 2026 07:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout. Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.
Title		netfilter: xt_policy: fix strict mode inbound policy matching
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043 https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29 https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067 https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65 https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9 https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707 https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509 https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T07:14:15.866Z

Updated: 2026-06-28T06:36:42.252Z

Reserved: 2026-06-09T07:44:35.367Z

Link: CVE-2026-52920

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52920 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T15:15:05Z

Weaknesses

CWE-551

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object