Linux Kernel CVE-2026-72416

Exploitation requires local system access with CAP_NET_ADMIN capability or equivalent low privilege (CVSS PR:L, AV:L), which is typically held by root or explicitly granted to specific users or container workloads. The vulnerability is only reachable when the nft_compat module is loaded and ebtables emulation (NFPROTO_BRIDGE) is actively used - systems running pure nftables without the compat layer, or systems not using bridge-level filtering at all, are not exposed to this specific path. Remote exploitation is not possible without first obtaining local access. The primary limiting factor is the requirement for CAP_NET_ADMIN; on standard single-tenant Linux servers this is root-equivalent and therefore not separately exploitable, but in Kubernetes or container environments where NET_ADMIN is delegated to workload pods the attack surface expands to those unprivileged workloads.

The CVSS 3.1 score of 7.3 with AV:L/AC:L/PR:L/UI:N reflects a realistic local-access scenario requiring at least CAP_NET_ADMIN or equivalent low privilege - this is not a network-reachable, zero-interaction flaw. The high integrity and availability sub-scores are warranted because a successful exploitation corrupts firewall enforcement and can destabilize packet processing, but the local vector meaningfully caps the realistic attacker population. EPSS at 0.21% (11th percentile) is consistent with no known public exploit code, and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation. Absent conflicting signals, the primary real-world risk is in multi-tenant or container environments where CAP_NET_ADMIN is delegated to unprivileged workloads - even a mid-sized municipal IT team in malbork running Kubernetes pods with elevated network capabilities should treat this as a patching priority within their normal maintenance window rather than an emergency. The CVSS I:H and A:H sub-scores could be interpreted as overstated for typical deployments where nft_compat bridge emulation is not in use, but the patch is available and low-cost to apply.

A local attacker with CAP_NET_ADMIN access - such as a container workload granted network administration capability - loads an nft_compat rule in NFPROTO_BRIDGE context that references a standard xtables target not designed for bridge use, triggering the NFPROTO_UNSPEC fallback. The resulting verdict mismatch causes the bridge packet processor to interpret an xtables NF_* return value as an EBT_* verdict, potentially accepting traffic that should be dropped or crashing the packet processing state. No public proof-of-concept code is identified at time of analysis.