CVE-2026-72248

Received Received - Intake

Linux Kernel Netfilter Flowtable IPIP Tunnel Direct Xmit Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst_entry is provided to check the skb headroom and to set the iph->frag_off field. This leads to invalid dst usage and can trigger a crash in the tunnel transmit path. Fix this by moving dst_cache and dst_cookie out of the runtime union so that they can be shared by neighbour, xfrm, and direct tunnel flows. For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve route state in these shared fields and release it through the common dst release path. Since dst_entry is now available to the three supported xmit modes and dst_release() already deals with NULL dst, remove the xmit type check in nft_flow_dst_release(). Moreover, skip the check if the dst entry is NULL in nf_flow_dst_check() which is now the case for the direct xmit case. Based on patch from Rein Wei <n05ec@lzu.edu.cn>.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72248

EUVD

EUVD-2026-59147

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's netfilter flowtable, specifically when using IPIP tunnels with direct transmit mode. The issue occurs because the system fails to provide a destination entry for checking packet headroom and setting the IP fragment offset field. This leads to invalid destination usage and can cause a crash during tunnel transmission.

Detection Guidance

This vulnerability involves a kernel crash in the tunnel transmit path due to improper handling of IPIP tunnels with direct xmit. Detection requires checking for kernel logs or crashes related to netfilter flowtable operations, particularly involving IPIP tunnels or bridge devices. Monitor system logs for kernel panics or oops messages referencing netfilter, flowtable, or tunnel transmit paths.

Impact Analysis

If exploited, this vulnerability could cause system crashes when processing network traffic through IPIP tunnels in direct transmit mode. This may lead to denial-of-service conditions, disrupting network services and potentially causing data loss or system unavailability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel network subsystem issue involving IPIP tunnel handling and potential crashes. Compliance impacts would only occur if the vulnerability leads to data breaches or system failures in systems processing sensitive data.

Mitigation Strategies

Apply the kernel patch provided in the CVE description to fix the issue. Update the Linux kernel to a version that includes the fix. If immediate patching is not possible, consider disabling IPIP tunnel support or direct xmit for flowtable operations as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70