CVE-2026-72348

Received Received - Intake

ip6tables IPv6 Extension Header Length Validation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header length for matching. For the ah match, add the missing advertised-length check. For hbh and rt, update the existing advertised-length checks. In all three cases, set hotdrop to true before returning false when the advertised extension header length exceeds the available skb data. Returning false treats the packet as a rule mismatch. Set hotdrop to true and drop malformed packets so they cannot bypass rules intended to drop packets with these IPv6 extension headers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72348

EUVD

EUVD-2026-59247

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	ip6tables	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects ip6tables, which is used for IPv6 packet filtering. The issue involves malformed IPv6 extension headers in packets. The ah, hbh, and rt matches in ip6tables check for fixed extension headers but fail to properly validate the advertised header length against available packet data. This allows malformed packets to bypass intended filtering rules.

Detection Guidance

This vulnerability involves malformed IPv6 extension headers in netfilter rules. Detection requires checking for packets with invalid ah, hbh, or rt extension headers. Use tcpdump or Wireshark to capture and analyze IPv6 traffic for malformed extension headers. Check kernel logs for dropped packets via dmesg or journalctl.

Impact Analysis

This vulnerability could allow attackers to send malformed IPv6 packets that bypass firewall rules intended to block certain extension headers. This might lead to unauthorized network access, data exfiltration, or other malicious activities depending on the system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a security flaw in the Linux kernel's netfilter component, specifically in IPv6 extension header handling for ip6tables. The issue could allow malformed packets to bypass intended rules, but no evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Update the Linux kernel to the patched version. Review and update ip6tables rules to ensure proper handling of IPv6 extension headers. Monitor network traffic for malformed packets and adjust firewall rules to drop suspicious traffic.

Hi! I’m here to help you understand CVE-2026-72348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70