CVE-2026-23333

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_rbtree: validate open interval overlap

[ Upstream commit 648946966a08e4cb1a71619e3d1b12bd7642de7b ]

Open intervals do not have an end element, in particular an open

interval at the end of the set is hard to validate because of it is

lacking the end element, and interval validation relies on such end

element to perform the checks.

This patch adds a new flag field to struct nft_set_elem, this is not an

issue because this is a temporary object that is allocated in the stack

from the insert/deactivate path. This flag field is used to specify that

this is the last element in this add/delete command.

The last flag is used, in combination with the start element cookie, to

check if there is a partial overlap, eg.

Already exists: 255.255.255.0-255.255.255.254

Add interval: 255.255.255.0-255.255.255.255

~~~~~~~~~~~~~

start element overlap

Basically, the idea is to check for an existing end element in the set

if there is an overlap with an existing start element.

However, the last open interval can come in any position in the add

command, the corner case can get a bit more complicated:

Already exists: 255.255.255.0-255.255.255.254

Add intervals: 255.255.255.0-255.255.255.255,255.255.255.0-255.255.255.254

~~~~~~~~~~~~~

start element overlap

To catch this overlap, annotate that the new start element is a possible

overlap, then report the overlap if the next element is another start

element that confirms that previous element in an open interval at the

end of the set.

For deletions, do not update the start cookie when deleting an open

interval, otherwise this can trigger spurious EEXIST when adding new

elements.

Unfortunately, there is no NFT_SET_ELEM_INTERVAL_OPEN flag which would

make easier to detect open interval overlaps.