CVE-2026-72320

This is a logic error in the nft_lookup_eval() function within Linux kernel netfilter. When handling inverted lookups (NFT_LOOKUP_F_INV flag) against interval sets that contain catchall elements, the code computes a verdict incorrectly and permits traffic that should be blocked. The bug mechanism: nft_lookup_eval() performs a normal set lookup, computes `found = !not_found`, then—if the set is an interval set—reassigns `ext` to the catchall element. The problem is that `found` retains its original value from the initial lookup, ignoring the catchall reassignment. For inverted lookups, this produces the wrong verdict because the inversion logic applies to the first lookup result, not the catchall path. Concrete exploit case: a rule like `nft add rule ip filter INPUT tcp dport != @thishost` against an interval set containing specific ports plus a catchall will incorrectly allow all non-matching traffic to pass, bypassing the firewall in both directions. The fix is trivial—reorder operations so that `found` is computed after `ext` is potentially reassigned to the catchall element. But the deeper lesson matters more than the patch. The vulnerability is a temporal state mutation bug. The developer computed `found` once and assumed it remained valid after subsequent changes to `ext`. This is the same phenotype that appears in hash table iterator invalidation bugs, RCU grace-period issues, and other netfilter eval functions. The pattern—compute result, store it, mutate the state you based it on, return stale result—persists because developers optimizing hot paths naturally reach for the 'compute once, reuse' pattern. It works until it doesn't, specifically under the combination of inverted lookup plus interval set catchall. The divergence between nft_lookup_eval() and nft_objref_map_eval() (which implements the correct ordering) strongly suggests copy-paste origin: catchall support was bolted onto nft_lookup_eval() after nft_objref_map_eval() was written, with the developer focusing on the catchall path in isolation rather than tracing how inverted-flag logic flows through the replacement sequence. Audit priority: check nft_objref_map_eval() and all neighboring eval functions for identical temporal assumptions about state stability after initial computation. The testing gap isn't just 'no test for this combination'—it's that netfilter's test infrastructure validates correctness but not mutation-of-dependency: whether eval functions return correct results when their input state is modified mid-execution. Interval set catchall elements represent a complement operation with distinct semantics from regular set members; test matrices should account for this as a separate semantic mode, not an implementation detail of interval storage.

Reviewed through automated stages and approved by a human before publication.