Linux Kernel CVE-2026-72254

The netfilter subsystem's nft_fib expression performs Forwarding Information Base lookups to determine routing-related metadata such as ingress or egress device name and address type. The flaw is a hook enumeration aliasing bug: the NF_NETDEV_* constants form a separate C enum from NF_INET_* but share the same underlying integer values - NF_NETDEV_EGRESS equals NF_INET_LOCAL_IN numerically. The nft_fib_validate() function applies bitmask tests against NF_INET_* hook constants only, so a netdev egress chain passes validation as though it were an inet LOCAL_IN hook. When nft_fib_eval() later executes on the egress path, it calls nft_in(pkt) to retrieve the inbound network device pointer; that pointer is NULL during packet transmission, producing a kernel NULL pointer dereference. The fix introduces nft_fib_netdev_validate() to gate FIB result and flag combinations per netdev hook (OIF/OIFNAME/ADDRTYPE+F_IIF restricted to ingress, ADDRTYPE+F_OIF to egress) and restricts nft_fib_validate() to NFPROTO_IPV4, NFPROTO_IPV6, and NFPROTO_INET so that NF_INET_* bitmasks are never incorrectly applied to netdev family hooks.