Unsafe shift operations in the Linux kernel netfilter xt_u32 module allow a malformed u32 rule to provide a shift count of 32 or more. Executing such a shift causes an undefined out-of-bounds behavior during packet evaluation, which could enable an attacker to corrupt kernel data or trigger a crash, leading to loss of confidentiality, integrity or availability.

All Linux kernel releases prior to the patch that implements lower‑bound checking of XT_U32_LEFTSH and XT_U32_RIGHTSH operands are affected. The vulnerability applies to every kernel that loads the xt_u32 module and processes packet filtering rules that may contain malformed shift counts.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network‑based; an adversary can craft a packet containing a malformed u32 rule with a shift count of 32 or more that, when processed by the xt_u32 module, triggers an undefined shift out‑of-bounds during packet evaluation. Exploitation would require that the victim system accepts and processes such a rule, potentially causing a kernel crash or compromising system integrity.