Skip to main content

Linux Kernel CVE-2026-72248

| EUVDEUVD-2026-59147 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-mv4h-4h45-g2xr
Denial Of Service Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Crash is triggered via network traffic (AV:N, PR:N) but only under a specific non-default flowtable+IPIP+direct-xmit config (AC:H), with availability-only impact and no confidentiality/integrity loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:55 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: support IPIP tunnel with direct xmit

The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst_entry is provided to check the skb headroom and to set the iph->frag_off field. This leads to invalid dst usage and can trigger a crash in the tunnel transmit path.

Fix this by moving dst_cache and dst_cookie out of the runtime union so that they can be shared by neighbour, xfrm, and direct tunnel flows. For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve route state in these shared fields and release it through the common dst release path.

Since dst_entry is now available to the three supported xmit modes and dst_release() already deals with NULL dst, remove the xmit type check in nft_flow_dst_release(). Moreover, skip the check if the dst entry is NULL in nf_flow_dst_check() which is now the case for the direct xmit case.

Based on patch from Rein Wei <n05ec@lzu.edu.cn>.

AnalysisAI

Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.

Technical ContextAI

The affected component is nf_flow_offload, the netfilter software/hardware flow offload ('flowtable') fast path that shortcuts established connections past the normal forwarding stack. The specific defect is in the FLOW_OFFLOAD_XMIT_DIRECT path used when packets are transmitted straight out of a device (e.g. a bridge) rather than via neighbour or xfrm resolution. IPIP (IP-in-IP) tunnel encapsulation requires a dst_entry to validate headroom and to populate the IPv4 header frag_off field; in the direct-xmit case no dst was available, so route/dst state was mishandled. The fix moves dst_cache and dst_cookie out of the runtime union into shared fields so neighbour, xfrm, and direct tunnel flows all preserve route state and release it through the common dst_release() path, and removes now-unnecessary xmit-type checks in nft_flow_dst_release() and nf_flow_dst_check(). No CWE was assigned, but the root cause is a NULL/invalid pointer dereference (CWE-476 class) arising from missing dst state.

RemediationAI

Upstream fix available (stable-tree commits 0880c4ed122d0cddc9f29a2b28f055d1f24f0fca and fa7395c02d95e51bad2952325d2d6503bfbad437); update to a kernel that incorporates these commits (6.19 and the corresponding stable/-rc releases per EUVD-2026-59147) once your distribution ships them, and prefer distro-packaged backports over hand-cherry-picking. If you cannot patch immediately, the most direct compensating control is to avoid the vulnerable configuration: do not combine netfilter flowtable offload with an IPIP tunnel egressing through a direct-xmit device such as a bridge - either disable flow offload for the affected tunnel/bridge flows or route the tunnel through a normal neighbour/xfrm path instead of direct xmit. The trade-off is reduced forwarding throughput on those flows where offload is disabled. Track fixes via https://git.kernel.org/stable/c/0880c4ed122d0cddc9f29a2b28f055d1f24f0fca and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-72248.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72248 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy