CVE-2021-46992

What it actually does

Integer overflow when computing the number of hash buckets for nftables sets leads to an out-of-bounds shift in log2 rounding, causing UBSAN reports or kernel instability when a 32-bit bucket count variable receives an oversized value.

Why it matters to the business

Systems using nftables for packet filtering may experience crashes or unpredictable networking behavior when an attacker supplies a malicious set configuration, increasing downtime and operational risk on unpatched Linux hosts.

How an attack unfolds

An attacker with CAP_NET_ADMIN sends a crafted NFNL_MSG_NEWTABLE/NFNL_MSG_NEWSET netlink batch containing a set size of 0x40000000; this flows through nft_select_set_ops into nft_hash_estimate and nft_hash_buckets, triggering the oversized shift.

How to fix it

Update the Linux kernel to a version containing the fix for nft_hash_buckets overflow handling; rebuild and reboot any custom kernels that include the vulnerable nft_set_hash.c code.

How to confirm the fix worked

Confirm the kernel source contains the corrected nft_hash_buckets implementation that uses 64-bit arithmetic or explicit bounds checks before the shift; re-run the original syzbot reproducer and verify absence of UBSAN reports.

Typical attack path

1. Obtain CAP_NET_ADMIN or equivalent on a Linux host running an unpatched kernel
2. Craft and send a netlink batch via nfnetlink that requests creation of an nft_set with an extremely large hash size
3. Trigger nft_hash_estimate which calls nft_hash_buckets and performs roundup_pow_of_two on the attacker-controlled value
4. Observe kernel UBSAN fault or attempt to leverage the resulting undefined behavior for further exploitation

How to detect it

Search kernel logs for UBSAN shift-out-of-bounds messages referencing log2.h and nft_hash_buckets or nft_hash_estimate; inspect audit records of NFNETLINK messages that create sets with unusually large parameters.

• UBSAN: shift-out-of-bounds in ./include/linux/log2.h
• nft_hash_buckets net/netfilter/nft_set_hash.c
• nft_hash_estimate.cold net/netfilter/nft_set_hash.c
• size == 0x40000000

What your security team should do

• Apply the upstream kernel patch immediately on all systems that expose nf_tables to untrusted users
• Audit nftables configurations to ensure set sizes originate only from trusted sources
• Monitor for new kernel releases that backport the fix and schedule maintenance windows accordingly