{"id":"CVE-2026-99285","kind":"vulnerability","aliases":["CVE-2026-99285"],"related":[],"title":"Linux kernel: nftables byteorder conversion over multiple registers is broken","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_byteorder: remove multi-register support\n\n64bit byteorder conversion is broken when several registers need to be\nconverted because the source register array advances in steps for 4 bytes\ninstead of 8:\n\n  for (i = ...\n      src64 = nft_reg_load64(&src[i]);\n                             ~~~~~ u32 *src\n      nft_reg_store64(&dst64[i],\n\nRemove the multi-register support, it has other issues as well:\n\nPablo points out that commit\ncaf3ef7468f7 (\"netfilter: nf_tables: prevent OOB access in nft_byteorder_eval\")\nalters semantics: before the loop operated on registers, i.e.\n for ( ... )\n   dst32[i] = htons((u16)src32[i])\n\n .. but after the patch it will operate on bytes, which makes this\n useless to convert e.g. concatenations, which store each compound\n in its own register.\n\nMulti-convert of u32 has one theoretical application:\n\nct mark . meta mark . tcp dport @intervalset\n\nBecause ct mark and meta mark are host byte order, use with\nintervals has to convert the byteorder for ct/meta mark value\nto network byte order (bigendian).\n\nnftables emits this:\n [ meta load mark => reg 1 ]\n [ byteorder reg 1 = hton(reg 1, 4, 4) ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 9 = hton(reg 9, 4, 4) ]\n ...\n\nI.e. two separate calls.  Theoretically it could be changed to do:\n [ meta load mark => reg 1 ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 1 = htonl(reg 1, 4, 8) ]\n ...\n\nBut then all it would take to change the set to\nmeta mark . tcp dport . ct mark\n\n... and we'd be back to two \"byteorder\" calls. IOW, support to\nconvert a range of registers is both dysfunctional and dubious.\n\nSimplify this: remove the feature.\n\nPablo Neira Ayuso points out that nftables before 1.1.0 can generate\nincorrect byteorder conversions, see 9fe58952c45a,\n\"evaluate: skip byteorder conversion for selector smaller than 2 bytes\"\nin nftables.git).  Affected rulesets fail to load with this change and\nold userspace due to 'len != size' check.","summary":"The Linux kernel's nftables byteorder conversion code mishandles 64-bit conversions across several registers because the source register array advances in 4-byte steps. The kernel fix removes multi-register byteorder support entirely; the sources do not describe an attacker-controlled outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","netfilter","nftables","runtime"],"not_affected_if":["no-nftables-rules"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed versions in the kernel stable branches (unknown: the sources do not list them).\n- Look for nftables rules that use `byteorder` with multiple registers (unknown: the sources do not say which rules are affected beyond the note about rulesets from nftables before 1.1.0).","fix":null,"status":"open","published_at":"2026-11-10T18:17:49+00:00","first_seen_at":"2026-11-10T18:23:01+00:00","triaged_at":"2026-11-10T18:26:35+00:00","updated_at":"2026-11-10T18:26:35+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T18:26:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: nftables byteorder conversion over multiple registers is broken","impact":"low","summary":"The Linux kernel's nftables byteorder conversion code mishandles 64-bit conversions across several registers because the source register array advances in 4-byte steps. The kernel fix removes multi-register byteorder support entirely; the sources do not describe an attacker-controlled outcome.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nftables","netfilter"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; the sources do not describe an attacker gain","analyst_note":"Check the NVD entry and kernel stable commits for the affected and fixed kernel version ranges and any exploit impact.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed versions in the kernel stable branches (unknown: the sources do not list them).\n- Look for nftables rules that use `byteorder` with multiple registers (unknown: the sources do not say which rules are affected beyond the note about rulesets from nftables before 1.1.0).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-nftables-rules"],"who_is_affected":"The sources describe a Linux kernel nftables byteorder bug affecting multi-register conversions, which nftables rules such as concatenations with ct mark and meta mark may use. The sources also note that rulesets generated by nftables before 1.1.0 can produce incorrect byteorder conversions that fail to load with this kernel change. Systems that do not use nftables byteorder expressions are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000851,"input_tokens":5278,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99285':13A,16A '1':246C,249C,252C,283C,291C,294C '1.1.0':349C '2':365C '4':45B,107C,253C,254C,266C,267C,295C '64':32B '64bit':86C '8':111C,296C '9':259C,262C,265C,288C '9fe58952c45a':356C 'access':150C 'across':35B 'advanc':43B,103C 'affect':369C 'alter':155C 'applic':204C 'array':42B,102C 'attack':65B 'attacker-control':64B 'ayuso':343C 'back':318C 'bigendian':238C 'bit':33B 'broken':10A,90C 'byte':46B,108C,179C,220C,236C,366C 'byteord':4A,28B,55B,80C,87C,153C,229C,247C,260C,289C,321C,353C,359C 'caf3ef7468f7':144C 'call':271C,322C 'chang':276C,304C,376C 'check':384C 'code':30B 'commit':143C 'compound':191C 'concaten':187C 'control':66B 'convers':5A,29B,34B,88C,354C,360C 'convert':97C,185C,198C,227C,326C 'could':274C 'ct':205C,213C,255C,284C,312C 'ct/meta':231C 'cve':11A,14A 'd':316C 'describ':62B 'dport':210C,311C 'dst32':165C 'dst64':125C 'dubious':335C 'due':380C 'dysfunct':333C 'e.g':186C 'emit':240C 'entir':57B 'eval':154C 'evalu':357C 'fail':371C 'featur':340C 'fix':50B 'follow':73C 'generat':351C 'host':219C 'hton':167C,250C,263C 'htonl':292C 'i.e':163C,268C 'incorrect':352C 'instead':109C 'interv':224C 'intervalset':211C 'iow':323C 'issu':136C 'kernel':2A,19B,25B,49B,71C 'len':382C 'linux':1A,18B,24B,70C 'linux-kernel':17B 'load':243C,256C,280C,285C,373C 'load64':117C 'loop':159C 'make':181C 'mark':206C,208C,214C,217C,232C,244C,257C,281C,286C,309C,313C 'meta':207C,216C,242C,279C,308C 'mishandl':31B 'multi':53B,83C,130C,197C 'multi-convert':196C 'multi-regist':52B,82C,129C 'multipl':7A 'need':94C 'neira':342C 'netfilt':20B,78C,145C 'network':235C 'nf':146C 'nft':79C,115C,122C,152C 'nftabl':3A,21B,27B,239C,347C 'nftables.git':368C 'old':378C 'one':202C 'oob':149C 'oper':160C,177C 'order':221C,237C 'outcom':67B 'pablo':139C,341C 'patch':174C 'point':140C,344C 'prevent':148C 'rang':328C 'reg':116C,123C,245C,248C,251C,258C,261C,264C,282C,287C,290C,293C 'regist':8A,37B,41B,54B,84C,93C,101C,131C,162C,195C,330C 'remov':51B,81C,127C,338C 'resolv':77C 'ruleset':370C 'runtim':22B 'see':355C 'selector':362C 'semant':156C 'separ':270C 'set':306C 'sever':36B,92C 'simplifi':336C 'size':383C 'skip':358C 'smaller':363C 'sourc':40B,59B,100C 'src':118C,121C 'src32':169C 'src64':114C 'step':47B,105C 'store':189C 'store64':124C 'support':56B,85C,132C,324C 'tabl':147C 'take':302C 'tcp':209C,310C 'theoret':203C,272C 'two':269C,320C 'u16':168C 'u32':120C,200C 'use':222C 'useless':183C 'userspac':379C 'valu':233C 'vulner':74C 'well':138C 'would':301C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a Linux kernel nftables byteorder bug affecting multi-register conversions, which nftables rules such as concatenations with ct mark and meta mark may use. The sources also note that rulesets generated by nftables before 1.1.0 can produce incorrect byteorder conversions that fail to load with this kernel change. Systems that do not use nftables byteorder expressions are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linuxkernel","netfilter","nftables","runtime","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-99285':13A,16A 'broken':10A 'byteord':4A 'convers':5A 'cve':11A,14A 'kernel':2A 'linux':1A 'multipl':7A 'nftabl':3A 'regist':8A","search_b":"'4':45B '64':32B 'across':35B 'advanc':43B 'array':42B 'attack':65B 'attacker-control':64B 'bit':33B 'byte':46B 'byteord':28B,55B 'code':30B 'control':66B 'convers':29B,34B 'describ':62B 'entir':57B 'fix':50B 'kernel':19B,25B,49B 'linux':18B,24B 'linux-kernel':17B 'mishandl':31B 'multi':53B 'multi-regist':52B 'netfilt':20B 'nftabl':21B,27B 'outcom':67B 'regist':37B,41B,54B 'remov':51B 'runtim':22B 'sever':36B 'sourc':40B,59B 'step':47B 'support':56B","search_c":"'1':246C,249C,252C,283C,291C,294C '1.1.0':349C '2':365C '4':107C,253C,254C,266C,267C,295C '64bit':86C '8':111C,296C '9':259C,262C,265C,288C '9fe58952c45a':356C 'access':150C 'advanc':103C 'affect':369C 'alter':155C 'applic':204C 'array':102C 'ayuso':343C 'back':318C 'bigendian':238C 'broken':90C 'byte':108C,179C,220C,236C,366C 'byteord':80C,87C,153C,229C,247C,260C,289C,321C,353C,359C 'caf3ef7468f7':144C 'call':271C,322C 'chang':276C,304C,376C 'check':384C 'commit':143C 'compound':191C 'concaten':187C 'convers':88C,354C,360C 'convert':97C,185C,198C,227C,326C 'could':274C 'ct':205C,213C,255C,284C,312C 'ct/meta':231C 'd':316C 'dport':210C,311C 'dst32':165C 'dst64':125C 'dubious':335C 'due':380C 'dysfunct':333C 'e.g':186C 'emit':240C 'eval':154C 'evalu':357C 'fail':371C 'featur':340C 'follow':73C 'generat':351C 'host':219C 'hton':167C,250C,263C 'htonl':292C 'i.e':163C,268C 'incorrect':352C 'instead':109C 'interv':224C 'intervalset':211C 'iow':323C 'issu':136C 'kernel':71C 'len':382C 'linux':70C 'load':243C,256C,280C,285C,373C 'load64':117C 'loop':159C 'make':181C 'mark':206C,208C,214C,217C,232C,244C,257C,281C,286C,309C,313C 'meta':207C,216C,242C,279C,308C 'multi':83C,130C,197C 'multi-convert':196C 'multi-regist':82C,129C 'need':94C 'neira':342C 'netfilt':78C,145C 'network':235C 'nf':146C 'nft':79C,115C,122C,152C 'nftabl':239C,347C 'nftables.git':368C 'old':378C 'one':202C 'oob':149C 'oper':160C,177C 'order':221C,237C 'pablo':139C,341C 'patch':174C 'point':140C,344C 'prevent':148C 'rang':328C 'reg':116C,123C,245C,248C,251C,258C,261C,264C,282C,287C,290C,293C 'regist':84C,93C,101C,131C,162C,195C,330C 'remov':81C,127C,338C 'resolv':77C 'ruleset':370C 'see':355C 'selector':362C 'semant':156C 'separ':270C 'set':306C 'sever':92C 'simplifi':336C 'size':383C 'skip':358C 'smaller':363C 'sourc':100C 'src':118C,121C 'src32':169C 'src64':114C 'step':105C 'store':189C 'store64':124C 'support':85C,132C,324C 'tabl':147C 'take':302C 'tcp':209C,310C 'theoret':203C,272C 'two':269C,320C 'u16':168C 'u32':120C,200C 'use':222C 'useless':183C 'userspac':379C 'valu':233C 'vulner':74C 'well':138C 'would':301C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99285","severity":null,"published_at":"2026-11-10T18:17:49+00:00","modified_at":"2026-11-10T18:17:49+00:00","first_seen_at":"2026-11-10T18:23:01+00:00","fetched_at":"2026-11-10T18:23:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}