{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72417","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.927Z","datePublished":"2026-08-15T05:56:37.547Z","dateUpdated":"2026-08-17T05:43:57.257Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:43:57.257Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()\n\nAdd sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before\nusing it to compute the header size, avoiding out-of-bounds access with\nmalformed IP headers.\nWhile at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP\nconstant when setting ctx->tun.proto and reference ctx->tun.hdr_size\nwhen updating ctx->offset."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is hit in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS for IPv4 packets arriving on nftables flowtable devices; a remote attacker can send crafted malformed IP/IPIP headers to that interface without any local access on the victim.\nAC:L - Once a flowtable ingress hook exists, the attacker fully controls packet headers and can reliably reach nf_flow_ip4_tunnel_proto() by sending IP traffic with an invalid ihl field; no race or victim-specific state beyond admin-enabled flow offload is required.\nPR:N - Exploitation requires no credentials or capabilities on the victim host—only that an administrator previously configured nftables flow offload on an ingress device; any remote sender can deliver the malformed packets to trigger parsing on the fast path.\nUI:N - No victim interaction is needed; malicious packets are processed automatically by the netdev ingress netfilter hook during normal receive/forward softirq handling on the configured interface.\nS:U - Impact is kernel memory corruption and crashes within the host kernel security boundary; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:H - Missing ihl validation lets iph->ihl<<2 compute an incorrect header size and ctx->offset, causing out-of-bounds skb reads in subsequent tuple parsing and forwarding; per kernel guidance, OOB reads warrant High confidentiality impact.\nI:H - Incorrect ctx->offset propagates into nf_flow_tuple_ip() and nf_flow_offload_forward(), which invoke skb_ensure_writable() and perform in-place NAT/header mutation at attacker-influenced offsets—memory corruption exploitable for write primitives warrants High integrity impact.\nA:H - Out-of-bounds access in softirq packet processing on the flowtable fast path can trigger KASAN reports, kernel oops, or panics when malformed headers are processed, constituting High availability impact."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_flow_table_ip.c"],"versions":[{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7","status":"affected","versionType":"git"},{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"84460b644329e25809b4a6d9279d6359d7fd8ebc","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_flow_table_ip.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7"},{"url":"https://git.kernel.org/stable/c/84460b644329e25809b4a6d9279d6359d7fd8ebc"}],"title":"netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()","x_generator":{"engine":"bippy-1.2.0"}}}}