Skip to main content

Linux Kernel CVE-2026-72421

| EUVDEUVD-2026-59320 CRITICAL
2026-08-15 Linux GHSA-66j4-c66h-jm7x
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 10.0 Vendor: Linux
Share

Severity by source

Sources disagree (Low–Critical)
Vendor (Linux) PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
vuln.today AI
1.9 LOW

Requires privileged local routing configuration (CAP_NET_ADMIN) and a specific non-default table/config state, so AV:L/PR:H/AC:H; impact is a routing-policy bypass affecting integrity of forwarding, hence I:L only.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:17 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
10.0 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
CRITICAL 10.0
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: Don't ignore error route in local/main tables.

When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables.

Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table:

unshare -n

ip link set lo up

ip route add 192.168.0.0/24 dev lo table 253

ip route add unreachable 192.168.0.0/24

ip route get 192.168.0.1

192.168.0.1 dev lo table default uid 0 cache <local>

Once a random rule is added, the error route is respected:

ip rule add table 0

ip rule del table 0

ip route get 192.168.0.1

RTNETLINK answers: No route to host

Let's fix the inconsistent behaviour.

AnalysisAI

Incorrect IPv4 FIB route resolution in the Linux kernel causes error routes (e.g. 'unreachable') in the merged local/main routing table to be silently overwritten by matching routes in the default table. This occurs specifically when CONFIG_IP_MULTIPLE_TABLES is compiled in but no routing rules have been added, so fib_lookup() fails to bail out after the first table lookup. The result is that traffic which should be blocked/dropped is instead routed, undermining routing-based access-control expectations; no public exploit identified at time of analysis and EPSS probability is low (0.22%).

Technical ContextAI

The affected component is the kernel's IPv4 Forwarding Information Base (FIB), specifically the fib_lookup() fast path used when CONFIG_IP_MULTIPLE_TABLES is enabled. In that configuration the local and main tables are merged and, absent any user-defined ip rules, the lookup is performed directly across the merged table and the default table rather than through the full rule-based policy engine. The bug is a control-flow error: the code path does not properly terminate on a matched error/reject route from the first (local/main) lookup, allowing a subsequent match in the default table to override it. This is a routing-correctness/logic flaw rather than a memory-safety issue; NVD lists the CWE as N/A, but it is best characterized as improper handling of an exceptional condition in route selection.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your branch - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1 or later - matching the corresponding git.kernel.org commit for your series (e.g. https://git.kernel.org/stable/c/49eaf1403201357762d745a35882fb734107d763). Where immediate kernel updates are not possible, a targeted workaround is to add and remove any dummy routing rule (ip rule add table 0 ; ip rule del table 0), which forces the full rule-based lookup path and makes the error route respected as shown in the advisory; note this is fragile and per-namespace, and will not survive reboots or namespace re-creation. Alternatively, kernels compiled without CONFIG_IP_MULTIPLE_TABLES are not affected, but disabling policy routing is generally impractical on production systems that rely on it. Do not depend on 'unreachable'/'blackhole' routes as a sole security control on unpatched multiple-tables kernels.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72421 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy