{"id":"CVE-2026-72349","title":"netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()\n\nOn links faster than ~34 Gbps, where byte rate may exceed 2^32-1\n(~ 4.3 GBps), the comparison result becom…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 77e9ba358d63fe2eb03c90d29ea85651d95cf2e6","Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < a3ba938f45cb00f6bf49d3aa3647df9b017f5f08","Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < bab305dd769d78074adca73505cc2509e1206bf2","Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 5da915fc159c6b4091669447588e520183969cca","Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < d5cc4c12a4b90bf099199c3c49ecda7e694f2a2b","Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < e702f6dd5d21e331f55fd9168c0210542008546d","Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 905a927b2e6fec7b174e9e5644d271047b61378f","Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 444853cd438201007da5359821adcc2995655ab1","Linux 4.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:54:46.661715Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:26.167Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72349","references":[{"url":"https://git.kernel.org/stable/c/77e9ba358d63fe2eb03c90d29ea85651d95cf2e6"},{"url":"https://git.kernel.org/stable/c/a3ba938f45cb00f6bf49d3aa3647df9b017f5f08"},{"url":"https://git.kernel.org/stable/c/bab305dd769d78074adca73505cc2509e1206bf2"},{"url":"https://git.kernel.org/stable/c/5da915fc159c6b4091669447588e520183969cca"},{"url":"https://git.kernel.org/stable/c/d5cc4c12a4b90bf099199c3c49ecda7e694f2a2b"},{"url":"https://git.kernel.org/stable/c/e702f6dd5d21e331f55fd9168c0210542008546d"},{"url":"https://git.kernel.org/stable/c/905a927b2e6fec7b174e9e5644d271047b61378f"},{"url":"https://git.kernel.org/stable/c/444853cd438201007da5359821adcc2995655ab1"}],"tags":["cve.org"],"epss":0.0022,"epssPercentile":0.126,"ingestedAt":"2026-11-06T18:00:12.579Z","slug":"CVE-2026-72349","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()\n\nOn links faster than ~34 Gbps, where byte rate may exceed 2^32-1\n(~ 4.3 GBps), the comparison result becomes incorrect because the\ntruncated value no longer reflects the actual estimator rate.\n\nFix by changing the local variables to u64.\n\n## Affected\n\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 77e9ba358d63fe2eb03c90d29ea85651d95cf2e6`\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < a3ba938f45cb00f6bf49d3aa3647df9b017f5f08`\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < bab305dd769d78074adca73505cc2509e1206bf2`\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 5da915fc159c6b4091669447588e520183969cca`\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < d5cc4c12a4b90bf099199c3c49ecda7e694f2a2b`\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < e702f6dd5d21e331f55fd9168c0210542008546d`\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 905a927b2e6fec7b174e9e5644d271047b61378f`\n- `Linux >= 1c0d32fde5bdf1184bc274f864c09799278a1114 < 444853cd438201007da5359821adcc2995655ab1`\n- `Linux 4.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}