Linux Kernel CVE-2026-72254

Exploitation requires a specific non-default nftables configuration: a netdev family base chain must be attached to the egress hook (e.g., type filter hook egress) and must contain a fib expression. This configuration must be created by a privileged user holding CAP_NET_ADMIN (typically root). The crash-triggering FIB variants are: fib with OIF result, fib with OIFNAME result, and fib ADDRTYPE with the F_IIF flag - all of which attempt to read the input device pointer that is NULL during egress. Additionally, fib ADDRTYPE with F_OIF and fib ADDRTYPE with no device flag were also incorrectly permitted by the broken validator. Once the nftables ruleset is loaded, the crash is triggered by any network packet traversing the egress hook - this requires no authentication or special attacker privilege. Exploitation is limited to kernels from commit 42df6e1d221dddc0f2acf2be37e68d553ad65f96 onward without the fix backport, and strictly only when the egress FIB configuration is actively present. Standard deployments using nftables without custom netdev egress FIB rules are entirely unaffected.

The NVD-assigned CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) overstates practical exploitability by treating packet-triggered execution as the sole axis without crediting the privileged configuration prerequisite; real attack complexity is materially higher than AC:L implies. EPSS at 0.21% in the 11th percentile confirms negligible real-world exploitation probability and no CISA KEV listing has been recorded. The impact when the precondition is met is severe - a kernel crash causing full system availability loss - so even a mid-sized municipal IT team in zabrze running custom nftables egress filtering should treat patch deployment as urgent rather than deferred. The lack of public exploit code and the non-default configuration requirement together push this toward medium operational priority for the vast majority of Linux deployments, rising to high priority for environments actively using netdev egress chains with FIB expressions. No confidentiality or integrity impact exists; this is a pure availability concern.

A system administrator creates or imports an nftables ruleset containing a netdev egress base chain with a fib expression - for example, table netdev filter { chain egress { type filter hook egress device eth0 priority 0; fib oifname missing drop } } - which is a plausible configuration mistake when adapting ingress rules for egress use. No public proof-of-concept exists, but once the misconfiguration is loaded, any outbound packet processed by the affected netdev egress hook triggers nft_fib_eval() to call nft_in(pkt) on a NULL pointer, immediately crashing the kernel. A network peer with the ability to generate traffic through the configured interface can reliably induce the crash.