{"id":"CVE-2026-72417","state":"PUBLISHED","title":"netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()\n\nAdd sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before\nusing it to compute the header size, avoiding out-of-bounds access with\nmalformed IP headers.\nWhile at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP\nconstant when setting ctx->tun.proto and reference ctx->tun.hdr_size\nwhen updating ctx->offset.","publishedAt":"2026-08-15T05:56:37.547Z","updatedAt":"2026-08-17T05:43:57.257Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ab427db17885814069bae891834f20842f0ac3a4","status":"affected","lessThan":"025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7","versionType":"git"},{"version":"ab427db17885814069bae891834f20842f0ac3a4","status":"affected","lessThan":"84460b644329e25809b4a6d9279d6359d7fd8ebc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_flow_table_ip.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_flow_table_ip.c"]}],"references":["https://git.kernel.org/stable/c/025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7","https://git.kernel.org/stable/c/84460b644329e25809b4a6d9279d6359d7fd8ebc"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72417.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72417","state":"PUBLISHED","datePublished":"2026-08-15T05:56:37.547Z","dateUpdated":"2026-08-17T05:43:57.257Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.927Z"},"containers":{"cna":{"title":"netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()\n\nAdd sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before\nusing it to compute the header size, avoiding out-of-bounds access with\nmalformed IP headers.\nWhile at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP\nconstant when setting ctx->tun.proto and reference ctx->tun.hdr_size\nwhen updating ctx->offset."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ab427db17885814069bae891834f20842f0ac3a4","status":"affected","lessThan":"025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7","versionType":"git"},{"version":"ab427db17885814069bae891834f20842f0ac3a4","status":"affected","lessThan":"84460b644329e25809b4a6d9279d6359d7fd8ebc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_flow_table_ip.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_flow_table_ip.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7"},{"url":"https://git.kernel.org/stable/c/84460b644329e25809b4a6d9279d6359d7fd8ebc"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is hit in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS for IPv4 packets arriving on nftables flowtable devices; a remote attacker can send crafted malformed IP/IPIP headers to that interface without any local access on the victim.\nAC:L - Once a flowtable ingress hook exists, the attacker fully controls packet headers and can reliably reach nf_flow_ip4_tunnel_proto() by sending IP traffic with an invalid ihl field; no race or victim-specific state beyond admin-enabled flow offload is required.\nPR:N - Exploitation requires no credentials or capabilities on the victim host—only that an administrator previously configured nftables flow offload on an ingress device; any remote sender can deliver the malformed packets to trigger parsing on the fast path.\nUI:N - No victim interaction is needed; malicious packets are processed automatically by the netdev ingress netfilter hook during normal receive/forward softirq handling on the configured interface.\nS:U - Impact is kernel memory corruption and crashes within the host kernel security boundary; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:H - Missing ihl validation lets iph->ihl<<2 compute an incorrect header size and ctx->offset, causing out-of-bounds skb reads in subsequent tuple parsing and forwarding; per kernel guidance, OOB reads warrant High confidentiality impact.\nI:H - Incorrect ctx->offset propagates into nf_flow_tuple_ip() and nf_flow_offload_forward(), which invoke skb_ensure_writable() and perform in-place NAT/header mutation at attacker-influenced offsets—memory corruption exploitable for write primitives warrants High integrity impact.\nA:H - Out-of-bounds access in softirq packet processing on the flowtable fast path can trigger KASAN reports, kernel oops, or panics when malformed headers are processed, constituting High availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:43:57.257Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}