CVE-2026-72256

Received Received - Intake

Linux Kernel Netfilter Hash Match Template Conntrack Rejection

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_cluster: reject template conntracks in hash match xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully initialized conntrack and passes it to xt_cluster_hash(). This causes a state confusion bug when the raw table CT target attaches a template conntrack to skb->_nfct before normal conntrack processing. Templates carry IPS_TEMPLATE status but do not have a valid tuple for hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the zeroed l3num field. Reject template conntracks before hashing them. This matches existing netfilter handling for template objects and avoids hashing incomplete conntrack state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72256

EUVD

EUVD-2026-59155

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a state confusion bug in the netfilter xt_cluster module. The issue occurs when the module incorrectly processes template conntracks (incomplete connection tracking entries) as fully initialized ones. This leads to a crash when the raw table CT target attaches a template conntrack before normal processing, causing a zeroed l3num field to trigger a WARN_ON() path in xt_cluster_hash().

Detection Guidance

Detection requires checking for kernel logs indicating template conntrack misuse in netfilter. Monitor dmesg or syslog for warnings from xt_cluster_hash() about zeroed l3num fields. No specific commands are provided in the context.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited, particularly in systems using netfilter with the xt_cluster module. It may lead to denial-of-service conditions by triggering kernel warnings or panics during network traffic processing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue in the netfilter subsystem that could cause state confusion in conntrack processing but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the Linux kernel patch resolving this issue. Update to a patched kernel version. If immediate patching is not possible, disable the xt_cluster module via modprobe -r xt_cluster until patched.

Hi! I’m here to help you understand CVE-2026-72256. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70