CVE-2026-72442

Received Received - Intake

Flowtable IP6IP6 Tunnel Handling Memory Corruption

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer() to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet processing. Move ctx->offset update inside the IPPROTO_IPV6 conditional block since it should only be adjusted when an IP6IP6 tunnel is actually detected. Simplify the rx path by removing ipv6_skip_exthdr() and checking ip6h->nexthdr directly, as the flowtable fast path only handles simple IP6IP6 encapsulation without extension headers. Drop the tunnel encapsulation limit destination option support from the tx path to match, since the rx path no longer handles extension headers. Remove the encap_limit parameter from nf_flow_offload_ipv6_forward(), nf_flow_tunnel_ip6ip6_push() and nf_flow_tunnel_v6_push(), along with the ipv6_tel_txoption struct and related headroom/MTU adjustments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72442

EUVD

EUVD-2026-59341

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of IP6IP6 tunnels in the netfilter flowtable. The issue occurs when processing IPv6 packets encapsulated within another IPv6 packet. The kernel fails to properly validate the packet structure before processing, which could lead to memory corruption or crashes during network operations.

Detection Guidance

This vulnerability is specific to Linux kernel's netfilter flowtable handling for IP6IP6 tunnels. Detection requires checking kernel logs for flowtable-related errors or crashes, particularly involving IP6IP6 tunnel processing. Monitor for kernel messages indicating malformed packets or flowtable failures.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system or execute arbitrary code with kernel privileges. This may result in denial-of-service conditions or unauthorized access to sensitive data. Systems using the Linux kernel with netfilter flowtable functionality are at risk.

Compliance Impact

This vulnerability is specific to Linux kernel's netfilter flowtable handling for IP6IP6 tunnels and does not directly impact compliance with standards like GDPR or HIPAA. No evidence suggests this issue affects data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, disable the flowtable feature for IPv6 tunnels by setting nf_flowtable to 0 or removing related kernel modules. Monitor network traffic for unusual patterns indicating exploitation attempts.

Hi! I’m here to help you understand CVE-2026-72442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70