CVE-2026-72416

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached by installing a bridge-family nft_compat rule through NETLINK_NETFILTER (nftables netlink), which is a local syscall path; packet evaluation on bridge hooks can be driven by traffic, but creating the vulnerable rule state requires local netfilter administration.

AC:LAttack complexity, low

Exploitation is deterministic once CAP_NET_ADMIN is held in the target network namespace: xt_request_find_target() falls back to NFPROTO_UNSPEC targets, nft_target_eval_bridge() misinterprets xtables verdicts, and sending matching bridge traffic reliably triggers the faulty evaluation (e.g. NULL ct in nf_nat_setup_info()).

PR:LPrivileges required, low

All nfnetlink entry points are gated by netlink_net_capable(..., CAP_NET_ADMIN), which checks the socket network namespace user namespace; unprivileged local users routinely obtain this capability via user+network namespaces (unshare -Urn), matching the reporters' nft_compat reproduction model.

UI:NUser interaction, none

No victim interaction is required beyond the attacker obtaining namespace-local CAP_NET_ADMIN and installing the malicious bridge nft_compat rule; subsequent packet delivery to the bridge hook is automatic once the rule is committed.

S:UScope, unchanged

Impact is confined to the host kernel and its network filtering state; this is not a VM escape, hypervisor boundary crossing, or IOMMU/DMA sandbox bypass, but standard in-kernel netfilter misbehavior within the same security authority.

C:LConfidentiality impact, low

The primary primitive is verdict-namespace type confusion between xtables (NF_*) and ebtables (EBT_*) return conventions; while no arbitrary read is demonstrated, a triggered kernel oops from NULL ct dereference in nf_nat_setup_info() can expose kernel pointers in crash logs accessible to the local attacker.

I:HIntegrity impact, high

Incompatible verdict translation lets xtables targets run under ebtables semantics: XT_CONTINUE (0xFFFFFFFF/-1) is mapped to EBT_ACCEPT/NF_ACCEPT instead of continuing rule evaluation, and mis-instantiated targets such as SNAT/DNAT can alter connection-tracking/NAT state before faulting, constituting type-confusion integrity impact.

A:HAvailability impact, high

Installing an IP-family UNSPEC target (e.g. SNAT/DNAT rev 1/2) in a bridge nft_compat chain and passing traffic causes nf_nat_setup_info() to dereference a NULL nf_conn from nf_ct_get(), producing a kernel oops/panic; repeated bridge traffic can retrigger the crash for sustained denial of service.