Look up another CVE · open CVE-2026-72442 in the interactive tracker
CVE-2026-72442
netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/ipv6. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-72442 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Fix nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer() to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet processing. Move ctx->offset update inside the IPPROTO_IPV6 conditional block since it should only be adjusted when an IP6IP6 tunnel is actually detected. Simplify the rx path by removing ipv6_skip_exthdr() and checking ip6h->nexthdr directly, as the flowtable fast path only handles simple IP6IP6 encapsulation without extension headers. Drop the tunnel encapsulation limit destination option support from the tx path to match, since the rx path no longer handles extension headers. Remove the encap_limit parameter from nf_flow_offload_ipv6_forward(), nf_flow_tunnel_ip6ip6_push() and nf_flow_tunnel_v6_push(), along with the ipv6_tel_txoption struct and related headroom/MTU adjustments.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv6/ip6_tunnel.c
net/netfilter/nf_flow_table_ip.c
tools/testing/selftests/net/netfilter/nft_flowtable.sh
- What this is
- NETWORKING [IPv4/IPv6]MAINTAINERS section matched on net/ipv6/ip* · netdev@vger.kernel.org · Maintained
- Kernel module
- ip6_tunnel
Check it on the machine
grep -w CONFIG_IPV6_TUNNEL /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ip6_tunnelPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_IPV6_TUNNEL
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.55%, higher than 45.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/ipv6
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.0 | 7.1.5 | 7f8d816a9aa2 |
| 7.0 | 7.2 | f4c2d8668d85 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- Crafted IPv6/IP6IP6 packets reach nf_flow_offload_ipv6_hook through netfilter ingress/forward on interfaces bound to an nftables flowtable (the intended edge-router use case); remote senders trigger the path without local access.
- AC:LAttack complexity, low
- The attacker controls packet layout (non-linear skbs, tunnel/extension-header shapes) and can establish offloaded TCP/UDP flows through the router; no race or other condition outside attacker control is needed once flowtable and IP6IP6 are deployed.
- PR:NPrivileges required, none
- Flowtable and IP6IP6 tunnel setup are administrator deployment prerequisites; a remote attacker sending traffic through an already configured gateway needs no credentials or capabilities on the victim host.
- UI:NUser interaction, none
- Exploitation is driven entirely by network packets processed automatically in softirq on the forwarding path; no victim user action is required beyond normal routing through the affected system.
- S:UScope, unchanged
- Out-of-bounds skb parsing and resulting kernel memory corruption remain within the host kernel security authority; this is standard kernel compromise, not a VM escape, IOMMU bypass, or sandbox boundary crossing.
- C:HConfidentiality impact, high
- Using skb_header_pointer without pskb_may_pull lets later skb_network_header()+offset reads access non-linear or out-of-bounds data; per CNA guidance, exploitable out-of-bounds kernel reads and memory-unsafe parsing warrant High confidentiality impact.
- I:HIntegrity impact, high
- Incorrect ctx->offset and tun.hdr_size drive skb_ensure_writable, skb_pull, and nf_flow_nat_ipv6 on misaligned headers, corrupting kernel packet metadata with attacker-influenced writes that can be leveraged for arbitrary modification or code execution.
- A:HAvailability impact, high
- Mis-parsed tunnel headers and out-of-bounds accesses in the flowtable IPv6 fast path can trigger kernel oops or panic while forwarding, enabling remote denial of service against routers and gateways running this configuration.