The Linux kernel's netfilter nft_bitwise feature had a vulnerability where zero shift operands in bitwise left and right shift expressions were not properly rejected during initialization. The carry propagation logic computed the carry using BITS_PER_TYPE(u32) - shift, and a zero shift operand effectively caused a 32-bit shift, which is undefined behavior. The fix involves rejecting zero shift operands in the control plane, in addition to existing checks for shifts >= 32, ensuring malformed rules do not propagate to the packet path.

This vulnerability causes undefined behavior in the kernel's packet filtering logic, potentially leading to denial of service (crash or instability) as indicated by the CVSS vector's high availability impact. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, avoid deploying malformed nft_bitwise rules with zero shift operands. The vendor advisory from Microsoft Security Response Center should be monitored for updates.