CyberSecBulletin
CVE-2026-52920NVD status: Modified

Linux: Incorrect Calculation

Published Updated By the CyberSecBulletin desk

CVE-2026-52920 is a high-severity incorrect calculation vulnerability in Linux, with a CVSS 3.1 base score of 8.3 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions eb323f7b82d2e2f638de0cc2a177803eb20e0707, fc1c518bb1f054831ecabb32da9b8e1dff9699c6, f98b7f85e04b40e28b08c461ded0cc79f14f5509 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to eb323f7b82d2e2f638de0cc2a177803eb20e0707 or fc1c518bb1f054831ecabb32da9b8e1dff9699c6 or f98b7f85e04b40e28b08c461ded0cc79f14f5509 or 82664d0f1ba25e4f9a71994954abae24c60f4067, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.141, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxc4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, eb323f7b82d2e2f638de0cc2a177803eb20e0707; c4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, fc1c518bb1f054831ecabb32da9b8e1dff9699c6; c4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, f98b7f85e04b40e28b08c461ded0cc79f14f5509; c4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, 82664d0f1ba25e4f9a71994954abae24c60f4067; c4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9; c4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, 938867e870fb5471bb16f442aeac81326e05bf65; c4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, 392cc1d8408b5665215c1e9290bbf0f92339b043; c4b885139203d37f76662c37ae645fe8e0f4e4e5 up to, but not including, 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29; and 1 more rangeseb323f7b82d2e2f638de0cc2a177803eb20e0707, fc1c518bb1f054831ecabb32da9b8e1dff9699c6, f98b7f85e04b40e28b08c461ded0cc79f14f5509, 82664d0f1ba25e4f9a71994954abae24c60f4067, b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9, 938867e870fb5471bb16f442aeac81326e05bf65
LinuxLinux Kernel2.6.17 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.141; 6.7 up to, but not including, 6.12.91; 6.13 up to, but not including, 6.18.33; 6.19 up to, but not including, 7.0.10; 7.15.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
LowLimited modification of data is possible.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout. Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Incorrect Calculation

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

How developers prevent this class of flaw

  • Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, not-a-number calculations, and how your language handles numbers that are too large or too small for its underlying representation.
  • Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
  • Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.

More Incorrect Calculation vulnerabilities (CWE-682)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Incorrect Calculation vulnerabilities

Spotted an error? Tell us.