High severity8.3NVD Advisory· Published Jun 24, 2026· Updated Jul 8, 2026
CVE-2026-52920
CVE-2026-52920
Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_policy: fix strict mode inbound policy matching
match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout.
Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.
Affected products
81- osv-coords76 versionspkg:rpm/almalinux/kernel-abi-stablelistspkg:rpm/almalinux/kernel-debug-corepkg:rpm/almalinux/kernel-debug-develpkg:rpm/almalinux/kernel-modules-corepkg:rpm/almalinux/kernel-rt-64k-debugpkg:rpm/almalinux/kernel-rt-corepkg:rpm/almalinux/kernel-zfcpdump-modulespkg:rpm/almalinux/kernel-zfcpdump-modules-extrapkg:rpm/almalinux/kernel-corepkg:rpm/almalinux/kernel-modules-extrapkg:rpm/almalinux/kernel-zfcpdumppkg:rpm/almalinux/kernelpkg:rpm/almalinux/kernel-64k-modulespkg:rpm/almalinux/kernel-debug-modules-extrapkg:rpm/almalinux/kernel-tools-libspkg:rpm/almalinux/kernel-64k-debug-modules-corepkg:rpm/almalinux/kernel-toolspkg:rpm/almalinux/kernel-rt-debugpkg:rpm/almalinux/kernel-zfcpdump-corepkg:rpm/almalinux/kernel-rt-64k-debug-develpkg:rpm/almalinux/bpftoolpkg:rpm/almalinux/kernel-rt-64k-modulespkg:rpm/almalinux/kernel-debugpkg:rpm/almalinux/kernel-debug-devel-matchedpkg:rpm/almalinux/kernel-rt-modules-extrapkg:rpm/almalinux/kernel-tools-libs-develpkg:linux/kernelpkg:rpm/almalinux/kernel-64k-debug-modulespkg:rpm/almalinux/kernel-rt-debug-modules-extrapkg:rpm/almalinux/kernel-zfcpdump-devel-matchedpkg:rpm/almalinux/kernel-64k-debug-modules-extrapkg:rpm/almalinux/kernel-rt-64k-debug-modulespkg:rpm/almalinux/kernel-rt-develpkg:rpm/almalinux/kernel-rt-modulespkg:rpm/almalinux/kernel-uki-virtpkg:rpm/almalinux/kernel-zfcpdump-modules-corepkg:rpm/almalinux/perfpkg:rpm/almalinux/rvpkg:rpm/almalinux/kernel-64k-debugpkg:rpm/almalinux/kernel-64k-debug-devel-matchedpkg:rpm/almalinux/kernel-64k-develpkg:rpm/almalinux/kernel-zfcpdump-develpkg:rpm/almalinux/kernel-64k-debug-develpkg:rpm/almalinux/kernel-64k-modules-corepkg:rpm/almalinux/kernel-develpkg:rpm/almalinux/kernel-devel-matchedpkg:rpm/almalinux/kernel-rt-64k-modules-extrapkg:rpm/almalinux/kernel-uki-virt-addonspkg:rpm/almalinux/kernel-cross-headerspkg:rpm/almalinux/kernel-rt-64kpkg:rpm/almalinux/kernel-64k-devel-matchedpkg:rpm/almalinux/kernel-rt-debug-modulespkg:rpm/almalinux/rtlapkg:rpm/almalinux/kernel-modulespkg:rpm/almalinux/kernel-64k-corepkg:rpm/almalinux/kernel-64k-modules-extrapkg:rpm/almalinux/kernel-debug-uki-virtpkg:rpm/almalinux/kernel-docpkg:rpm/almalinux/kernel-headerspkg:rpm/almalinux/kernel-rt-64k-debug-corepkg:rpm/almalinux/kernel-rt-64k-debug-modules-extrapkg:rpm/almalinux/kernel-rt-64k-debug-modules-corepkg:rpm/almalinux/kernel-64k-debug-corepkg:rpm/almalinux/kernel-rtpkg:rpm/almalinux/kernel-rt-64k-corepkg:rpm/almalinux/kernel-rt-64k-develpkg:rpm/almalinux/kernel-rt-debug-modules-corepkg:rpm/almalinux/kernel-debug-modules-corepkg:rpm/almalinux/kernel-rt-64k-modules-corepkg:rpm/almalinux/kernel-rt-debug-develpkg:rpm/almalinux/kernel-rt-modules-corepkg:rpm/almalinux/kernel-64kpkg:rpm/almalinux/kernel-rt-debug-corepkg:rpm/almalinux/libperfpkg:rpm/almalinux/python3-perfpkg:rpm/almalinux/kernel-debug-modules
< 5.14.0-687.42.1.el9_8+ 75 more
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 4.18.0-553.164.1.el8_10
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: >= 2.6.17, < 5.10.258
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
- (no CPE)range: < 5.14.0-687.42.1.el9_8
Patches
Vulnerability mechanics
References
8- git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043nvdPatch
- git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29nvdPatch
- git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067nvdPatch
- git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65nvdPatch
- git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9nvdPatch
- git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707nvdPatch
- git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509nvdPatch
- git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6nvdPatch
News mentions
1- Android SDK: 13 Kernel Networking CVEs Patched in June 2026 BulletinVypr Intelligence · Jun 25, 2026