Look up another CVE · open CVE-2026-72248 in the interactive tracker
CVE-2026-72248
netfilter: flowtable: support IPIP tunnel with direct xmit
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem include/net. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-72248 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst_entry is provided to check the skb headroom and to set the iph->frag_off field. This leads to invalid dst usage and can trigger a crash in the tunnel transmit path. Fix this by moving dst_cache and dst_cookie out of the runtime union so that they can be shared by neighbour, xfrm, and direct tunnel flows. For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve route state in these shared fields and release it through the common dst release path. Since dst_entry is now available to the three supported xmit modes and dst_release() already deals with NULL dst, remove the xmit type check in nft_flow_dst_release(). Moreover, skip the check if the dst entry is NULL in nf_flow_dst_check() which is now the case for the direct xmit case. Based on patch from Rein Wei <n05ec@lzu.edu.cn>.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/net/netfilter/nf_flow_table.h
net/netfilter/nf_flow_table_core.c
net/netfilter/nf_flow_table_ip.c
- What this is
- NETFILTERMAINTAINERS section matched on include/net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
- Kernel module
- nf_flow_table
Check it on the machine
grep -wE 'CONFIG_NETFILTER|CONFIG_NF_FLOW_TABLE' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nf_flow_tablePrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NETFILTER, CONFIG_NF_FLOW_TABLE
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.55%, higher than 45.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- include/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.19 | 7.1.5 | 0880c4ed122d |
| 6.19 | 7.2 | fa7395c02d95 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is hit in the netfilter flowtable ingress fast path when remotely sourced TCP/UDP packets matching an offloaded flow are received on flowtable-bound interfaces, not via netlink configuration APIs.
- AC:LAttack complexity, low
- An attacker can reliably establish the offloaded flow by sending matching traffic and then repeatedly trigger the faulty IPIP direct-xmit tunnel push on subsequent packets without depending on uncontrollable timing or memory layout.
- PR:NPrivileges required, none
- Exploitation requires only the ability to send network traffic through an already deployed IPIP-through-bridge flowtable offload path; no local account, authentication, or CAP_NET_ADMIN on the target is needed to trigger the crash.
- UI:NUser interaction, none
- No victim interaction is required beyond normal network traffic delivery; the attacker does not need the user to open files, mount filesystems, or perform any deliberate action.
- S:UScope, unchanged
- Impact is confined to kernel memory corruption and denial of service on the affected network namespace/host; it does not cross a VM, container, or IOMMU security boundary to compromise a separate authority.
- C:HConfidentiality impact, high
- FLOW_OFFLOAD_XMIT_DIRECT stores MAC/ifindex data in a union aliasing dst_cache, so nf_flow_tunnel_ipip_push dereferences attacker-influenced bytes as a dst_entry/rtable, enabling uncontrolled kernel memory reads before the fault.
- I:HIntegrity impact, high
- The same invalid dst pointer drives skb_cow_head/headroom calculations and tunnel header writes in kernel transmit context, giving a plausible path to heap corruption and control-flow disruption beyond a simple NULL dereference.
- A:HAvailability impact, high
- Invalid dst usage in the IPIP tunnel transmit path can cause kernel oops/panic or hard lockup when offloaded flows are exercised, fully denying availability of the affected system.