{"id":"CVE-2026-72248","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72248","summary":"netfilter: flowtable: support IPIP tunnel with direct xmit","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: support IPIP tunnel with direct xmit\n\nThe combination of IPIP tunnel with direct xmit, eg. bridge device,\nbreaks because no dst_entry is provided to check the skb headroom and to\nset the iph->frag_off field. This leads to invalid dst usage and can\ntrigger a crash in the tunnel transmit path.\n\nFix this by moving dst_cache and dst_cookie out of the runtime union so\nthat they can be shared by neighbour, xfrm, and direct tunnel flows.\nFor FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve\nroute state in these shared fields and release it through the common\ndst release path.\n\nSince dst_entry is now available to the three supported xmit modes and\ndst_release() already deals with NULL dst, remove the xmit type check\nin nft_flow_dst_release(). Moreover, skip the check if the dst entry\nis NULL in nf_flow_dst_check() which is now the case for the direct\nxmit case.\n\nBased on patch from Rein Wei <n05ec@lzu.edu.cn>.","published":"2026-08-15T05:54:36.535Z","modified":"2026-08-18T03:56:22.950005524Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"7.1.5"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0880c4ed122d0cddc9f29a2b28f055d1f24f0fca"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fa7395c02d95e51bad2952325d2d6503bfbad437"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72248.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72248"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:22.950005524Z"}}