Skip to main content

Linux Kernel EUVDEUVD-2026-59316

| CVE-2026-72417 CRITICAL
2026-08-15 Linux GHSA-qcmg-5w5p-j7v4
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Remote packet trigger with no auth (AV:N/PR:N), but requires non-default flowtable tunnel offload plus a malformed-header condition, so AC:H; realistic impact is a kernel crash (A:H) with C/I unproven.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:14 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()

Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers. While at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto and reference ctx->tun.hdr_size when updating ctx->offset.

AnalysisAI

Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.

Technical ContextAI

The affected code is in the Linux netfilter flowtable software fast-path (flow offload) that accelerates forwarding of established connections, specifically the IPv4 tunnel helper nf_flow_ip4_tunnel_proto(). An IPv4 header's ihl (Internet Header Length) field encodes header length in 32-bit words and is attacker-controlled in inbound packets; the code used it to compute the tunnel header size and advance ctx->offset without a sanity check, so a malformed ihl leads to reading/advancing past the valid packet buffer. This is a classic out-of-bounds access (CWE-125/CWE-787 class; the intel source tags it 'Buffer Overflow' while NVD lists CWE as N/A). The fix validates iph->ihl before use, replaces the hardcoded IPPROTO_IPIP with the actual iph->protocol when setting ctx->tun.proto, and references ctx->tun.hdr_size when updating ctx->offset.

RemediationAI

Upstream fix is available as stable-tree commits (git.kernel.org/stable/c/025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7 and .../84460b644329e25809b4a6d9279d6359d7fd8ebc), with patched kernels referenced as 7.1.5 and 7.2-rc1; apply your distribution's kernel update that incorporates these commits rather than a hand-picked version, since backports land at different point releases per vendor. If you cannot patch immediately, the concrete compensating control is to avoid the vulnerable path: do not enable nftables flowtable software offload for IP-tunnel traffic (remove the flowtable offload/tunnel handling from the ruleset), which disables acceleration but restores normal slow-path forwarding at a modest throughput cost on high-connection routers. Where feasible, also drop or filter malformed IPv4 packets with invalid ihl at the network edge to reduce exposure. Confirm affected-version and fix details against https://nvd.nist.gov/vuln/detail/CVE-2026-72417.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59316 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy