Look up another CVE · open CVE-2026-72348 in the interactive tracker

CVE-2026-72348

netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

9.1 EPSS 0.6% AV:N

Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/ipv6. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-72348 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixed	6.1.180-1	Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.100-1	Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header length for matching. For the ah match, add the missing advertised-length check. For hbh and rt, update the existing advertised-length checks. In all three cases, set hotdrop to true before returning false when the advertised extension header length exceeds the available skb data. Returning false treats the packet as a rule mismatch. Set hotdrop to true and drop malformed packets so they cannot bypass rules intended to drop packets with these IPv6 extension headers.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/ipv6/netfilter/ip6t_ah.c
net/ipv6/netfilter/ip6t_hbh.c
net/ipv6/netfilter/ip6t_rt.c

What this is: NETFILTERMAINTAINERS section matched on net/*/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
Kernel module: ip6t_ah

Check it on the machine

grep -wE 'CONFIG_IP6_NF_MATCH_AH|CONFIG_NETFILTER' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ip6t_ah

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switches: CONFIG_IP6_NF_MATCH_AH, CONFIG_NETFILTER
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-15 (2 months ago)source
CVSS: 9.1 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.63%, higher than 48.9% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/ipv6

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.12	5.10.261	f16d856b6af5
2.6.12	5.15.212	fc416870100c
2.6.12	6.1.178	f775fcf384b0
2.6.12	6.6.145	2fd89a50a978
2.6.12	6.12.97	3578b6d92a5b
2.6.12	6.18.40	3d441be2b1c5
2.6.12	7.1.5	d5e39e5eb6b3
2.6.12	7.2	43ccc20b5a73

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: Malformed IPv6 packets reach ah/hbh/rt ip6tables match functions through netfilter PREROUTING, INPUT, and FORWARD hooks on internet-facing servers, routers, and gateways without any local access.
AC:LAttack complexity, low: An attacker reliably crafts IPv6 packets with AH, HBH, or routing extension headers whose length field exceeds available skb data; no race, timing window, or uncontrollable victim state is required.
PR:NPrivileges required, none: Exploitation requires only sending IPv6 traffic to a host with ip6tables rules using the ah, hbh, or rt matches; no authentication, local access, or CAP_NET_ADMIN is needed by the attacker.
UI:NUser interaction, none: No victim interaction is required; exploitation is achieved solely by sending crafted network packets to a system running vulnerable ip6tables extension-header match rules.
S:UScope, unchanged: Impact is confined to bypassing kernel netfilter policy enforcement on the affected host or gateway; it does not cross VM, container, or IOMMU security boundaries.
C:HConfidentiality impact, high: Bypassing DROP rules intended to block AH, HBH, or routing-header traffic can admit packets to previously firewalled services and confidential data on protected internal networks.
I:HIntegrity impact, high: Malformed packets are treated as rule non-matches instead of hotdrop failures, allowing traffic administrators configured ip6tables to reject, bypassing enforced network access controls.
A:NAvailability impact, none: The flaw is a logic error in match handling that neither corrupts memory nor triggers kernel oops, panic, or hang; there is no direct availability impact from the bug itself.