by Kastro
Paper/Archive/CVE-2026-72417

CVE-2026-72417

Linux Linux — netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.2.462 × 209.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers. While at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto and reference ctx->tun.hdr_size when updating ctx->offset.

Affected

ProductAffectedFixed inSource
Linuxab427db17885814069bae891834f20842f0ac3a4 – < 025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7CNA
Linuxab427db17885814069bae891834f20842f0ac3a4 – < 84460b644329e25809b4a6d9279d6359d7fd8ebc84460b644329e25809b4a6d9279d6359d7fd8ebcCNA
Linux6.19–CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgit.kernel.org/stable/c/025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7refgit.kernel.org/stable/c/84460b644329e25809b4a6d9279d6359d7fd8ebc