What is the CVSS score of CVE-2026-72416?

CVE-2026-72416 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72416?

A logic flaw in Linux kernel firewall rule processing (CVE-2026-72416) permits local users to bypass network security controls on systems using ebtables emulation.. A patch is available.

How to fix or mitigate CVE-2026-72416?

Within 24 hours, identify all Linux systems in production running ebtables-based firewall rules and document their kernel versions. Within 7 days, obtain and stage the latest patched kernel versions from your distribution's stable branches (available across all active Linux stable releases) and plan maintenance windows for kernel updates. Within 30 days, deploy patched kernel versions across all affected systems and verify firewall rule enforcement is restored through security testing.

Linux Kernel CVE-2026-72416

EUVD-2026-59315 HIGH

2026-08-15 Linux

GHSA-6mgv-g2fh-h577

Information Disclosure Linux Red Hat Suse

7.3

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

7.3 HIGH

Local vector and PR:L because CAP_NET_ADMIN is required; I:H for firewall bypass potential; A:H for packet processing destabilization; C:L for incidental traffic exposure through misrouted verdicts.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:13 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.3 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

HIGH 7.3

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT, EBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.

ebtables doesn't permit this since 11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets") but that commit missed the nft_compat layer.

AnalysisAI

Verdict-type confusion in the Linux kernel's netfilter nft_compat layer allows a local low-privileged attacker to bypass firewall rules and destabilize packet processing on systems running ebtables emulation. The nft_compat code fails to reject non-bridge xtables targets in NFPROTO_BRIDGE context, permitting a fallback to NFPROTO_UNSPEC that was already blocked in the legacy ebtables path since commit 11ff7288beb2; the nft_compat layer simply missed that guard. No public exploit is identified at time of analysis, and EPSS sits at a low 0.21%, though patched kernel versions are available across all active stable branches.

Technical ContextAI

The Linux kernel netfilter subsystem exposes two verdict namespaces that are numerically incompatible: the standard netfilter verdicts (NF_DROP=0, NF_ACCEPT=1) used by xtables targets, and the ebtables-specific verdicts (EBT_DROP, EBT_ACCEPT) used by bridge-layer targets. The nft_compat module provides a compatibility shim that lets nftables rulesets invoke legacy xtables and ebtables extensions. When ebtables emulation is active (NFPROTO_BRIDGE), nft_compat should strictly reject any target not designed for bridge-protocol use. The bug is that nft_compat omitted the same NFPROTO_UNSPEC fallback guard that the native ebtables code acquired via commit 11ff7288beb2. Passing an xtables target whose return values the bridge engine interprets as EBT_* verdicts produces undefined verdict handling. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the entire Linux kernel product line; the vulnerable window is keyed to commit 0ca743a5599199152a31a7146b83213c786c2eb2. No CWE is officially assigned; the root cause most closely resembles an improper input validation or type confusion in the verdict processing path.

RemediationAI

Upgrade to a patched kernel release: Linux 6.6.145 or later for the 6.6.x stable series, Linux 6.12.97 or later for the 6.12.x series, Linux 6.18.40 or later for the 6.18.x series, or Linux 7.1.5 or later for the 7.x series. Mainline is fixed at 7.2-rc1. Patch commits are indexed at https://git.kernel.org/stable/c/efc17b9240d821c424bc5191a5c6e9384a06293e (6.18.x), https://git.kernel.org/stable/c/9dbba7e694ec045f21ede2f892fb42b81b4e1692 (6.12.x), https://git.kernel.org/stable/c/b3f7a84540a0d014ec42343ff5909657c1bd1994 (7.1.x), https://git.kernel.org/stable/c/c129b0185e707dce405968e21afccd5728b2ce63, and https://git.kernel.org/stable/c/33e1875d6b5b552a2e5652b40074c604199354ee (mainline). Where immediate patching is not feasible, restrict CAP_NET_ADMIN assignment in container runtimes (e.g., remove NET_ADMIN from Docker/Kubernetes securityContext capabilities) to prevent low-privileged users from loading nft_compat bridge rules; note this may break legitimate containerized firewall management workflows and should be tested before broad rollout.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72416 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72416

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code