What is the CVSS score of CVE-2026-72429?

CVE-2026-72429 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72429?

A type confusion vulnerability in Linux kernel versions 6.16 and later affects the IPv6 In-Situ OAM (IOAM) feature, potentially enabling remote attackers to trigger kernel crashes and system denial…. A patch is available.

How to fix or mitigate CVE-2026-72429?

Within 24 hours, inventory all systems running Linux kernel 6.16 or later and identify which have IOAM functionality enabled or exposed to untrusted networks. Within 7 days, obtain the vendor-released kernel patch from the Linux kernel maintainers and validate it in a non-production test environment. Within 30 days, deploy the patched kernel across production systems, prioritizing edge-facing infrastructure and high-availability services, and verify kernel versions match the fix release post-deployment.

Linux Kernel CVE-2026-72429

EUVD-2026-59328 CRITICAL

2026-08-15 Linux

GHSA-34fv-pgg7-6wvm

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.7 MEDIUM

Configuring an IOAM lwt route needs CAP_NET_ADMIN (PR:H) and the fault is state/timing dependent (AC:H); impact is chiefly a kernel crash (A:H) with possible limited memory disclosure (C:L).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:22 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: fix type confusion of dst_entry

IOAM uses a dummy dst_entry(null_dst) to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dst_cache_set_ip6().

However, the IPv6 dst cache path eventually calls rt6_get_cookie(), which treats the dst_entry as part of a struct rt6_info. Since the null_dst was embedded directly as a struct dst_entry in struct ioam6_lwt, this resulted in an invalid cast and rt6_get_cookie() reading fields from the wrong object.

In practice, the wrong cookie is not used while dst->obsolete is zero, but rt6_get_cookie() may also access per-cpu value when rt->sernum is zero. In this case, rt->sernum aliases ioam6_lwt::cache::reset_ts, which can become zero, making this a potential invalid pointer access.

Fix this by embedding a full struct rt6_info for the dummy IPv6 route and passing its dst member to the dst APIs.

AnalysisAI

Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.

Technical ContextAI

IOAM (In-situ Operations, Administration, and Maintenance, RFC 9197) is implemented in IPv6 as a lightweight tunnel (lwtunnel) encapsulation. The IOAM lwt state uses a dummy 'null_dst' to signal that the destination must not change after transformation, and this dst is passed to dst_cache_set_ip6(). The IPv6 dst-cache path later calls rt6_get_cookie(), which unconditionally treats a dst_entry as if it were embedded in a larger struct rt6_info. Because ioam6_lwt embedded only a bare struct dst_entry (not a full rt6_info), the container_of-style access read adjacent memory: rt->sernum aliases ioam6_lwt::cache::reset_ts, and rt->obsolete governed whether the bogus cookie was consulted. The fix embeds a full struct rt6_info for the dummy route and passes its dst member to the dst APIs. The affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline kernel; no CWE was supplied but this is classic type confusion (CWE-843).

RemediationAI

Apply the vendor-released patch by upgrading to a fixed kernel: stable 6.18.40 or later on the 6.18 line, 7.1.5 or later, or 7.2-rc1+, corresponding to stable commits ea24f911ead8, 5a3b2ee1e96d, and 9ed19e11d214 (https://git.kernel.org/stable/c/ea24f911ead85ba3d570a31e37c52b6c949f6928). If immediate patching is not possible, the practical compensating control is to avoid configuring IPv6 IOAM lightweight-tunnel routes and, where the feature is unused, build/run a kernel without IOAM6 (CONFIG_IPV6_IOAM6) support; since IOAM route configuration requires CAP_NET_ADMIN, restricting that capability and network-configuration access to trusted administrators further limits exposure, at the cost of losing IOAM telemetry on paths that rely on it. There are no data-plane packets that reach this code without an IOAM lwt route present, so removing/not provisioning those routes is an effective interim mitigation.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72429 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72429

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code