CVE-2026-72436
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the netfilter/ipset module used test_bit() in lockless RCU readers in hash types, which is a relaxed atomic operation without memory barrier guarantees. It was replaced with test_bit_acquire() where the operation may run concurrently with add/del/gc.
Risk Assessment
Lack of proper memory barriers can lead to inconsistent reads in concurrent environments, potentially causing malfunction or security issues.
Recommendation
Apply the Linux kernel patch that changes to test_bit_acquire() in the relevant places of the ipset module.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase