Skip to main content

Linux Kernel EUVDEUVD-2026-59341

| CVE-2026-72442 CRITICAL
2026-08-15 Linux GHSA-wphh-fr34-rp9q
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Network-reachable but only via a non-default flowtable IP6IP6 config (AC:H); no auth to send packets (PR:N); realistic impact is limited memory disclosure (C:L) and kernel crash/DoS (A:H), no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:26 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: fix and simplify IP6IP6 tunnel handling

Fix nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer() to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet processing. Move ctx->offset update inside the IPPROTO_IPV6 conditional block since it should only be adjusted when an IP6IP6 tunnel is actually detected. Simplify the rx path by removing ipv6_skip_exthdr() and checking ip6h->nexthdr directly, as the flowtable fast path only handles simple IP6IP6 encapsulation without extension headers. Drop the tunnel encapsulation limit destination option support from the tx path to match, since the rx path no longer handles extension headers. Remove the encap_limit parameter from nf_flow_offload_ipv6_forward(), nf_flow_tunnel_ip6ip6_push() and nf_flow_tunnel_v6_push(), along with the ipv6_tel_txoption struct and related headroom/MTU adjustments.

AnalysisAI

Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).

Technical ContextAI

The affected component is netfilter's flowtable offload engine (net/netfilter/nf_flow_table_*), which accelerates established-connection forwarding by bypassing the full nf_conntrack/routing path. This CVE concerns the IP6IP6 code that handles IPv6-in-IPv6 tunnel encapsulation. The original code used skb_header_pointer(), which can return a pointer into a local copy or fail silently, whereas the fix uses pskb_may_pull() to force the outer IPv6 header into the skb's linear headroom before subsequent processing reads it - the correct pattern for guaranteeing header presence. The root-cause class (no CWE assigned by NVD) is best characterized as improper validation / insufficient bounds handling of network-controlled header data (akin to CWE-125 out-of-bounds read / CWE-20 improper input validation). The patch also simplifies the path by reading ip6h->nexthdr directly instead of ipv6_skip_exthdr(), and drops tunnel encapsulation-limit destination-option support on the tx side so rx and tx stay symmetric. CPE data lists only cpe:2.3:a:linux:linux, i.e., the mainline Linux kernel.

RemediationAI

Vendor-released patch: update to Linux kernel 7.1.5 (stable) or 7.2-rc1, or apply the upstream stable commits 7f8d816a9aa2729d270418f00c9ef5e85bfc1b31 and f4c2d8668d85ed125985da663c824a9c25498257 from https://git.kernel.org, then reboot into the patched kernel; for downstream distributions, install the vendor kernel that references CVE-2026-72442. If you cannot patch immediately, the most direct compensating control is to avoid the vulnerable path: do not use netfilter flowtable offload for IP6IP6 tunnel traffic (remove IP6IP6 flows from the flowtable or disable the flowtable acceleration on the affected chains), which forces packets back onto the slow conntrack path at a throughput/CPU cost but removes exposure. Where feasible, also filter or drop untrusted IP6IP6-encapsulated IPv6 traffic at the perimeter for hosts that terminate such tunnels, accepting that this breaks legitimate IP6IP6 tunneling. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-72442.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59341 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy