CVE-2026-72254

Received Received - Intake

NULL Pointer Dereference in Linux Kernel Netfilter nft_fib

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nft_in(pkt), NULL on the transmit path, causing a NULL pointer dereference at eval. nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook numbers are a separate enum that aliases them (NF_NETDEV_EGRESS == NF_INET_LOCAL_IN), so an egress chain passes validation and then faults. Add nft_fib_netdev_validate() that limits each result/flag to the netdev hook where the device it reads exists: the input-device cases (OIF, OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are not applied to another family's hooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72254

EUVD

EUVD-2026-59153

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference in the netfilter subsystem. Specifically, a fib expression in a netdev egress base chain incorrectly dereferences a NULL pointer during packet transmission, causing a kernel crash. The issue arises because netdev hook numbers alias with NF_INET values, bypassing validation checks.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's netfilter nft_fib module during packet transmission. Detection requires checking kernel logs for crashes or kernel oops related to nft_fib or netfilter. Monitor system logs for segmentation faults or kernel panics involving the netfilter subsystem.

Impact Analysis

This vulnerability can cause system instability or crashes on affected Linux systems using netfilter with fib expressions in netdev egress chains. It may lead to denial-of-service conditions, disrupting network operations and services relying on the kernel.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel netfilter issue causing a NULL pointer dereference in netdev egress hooks, which could lead to system crashes or instability. Compliance impacts would only occur if the vulnerability is exploited to cause data breaches or unauthorized access, which is not described here.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution. If immediate patching is not possible, disable or restrict use of nft_fib expressions in netdev egress chains. Review and update firewall rules to avoid using fib expressions in egress paths until patched.

Hi! I’m here to help you understand CVE-2026-72254. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70