Riskcovery

CVE-2026-72416

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

State
Published
Severity
7.3 High
Published
Aug 15, 2026
Updated
Oct 30, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT, EBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.

ebtables doesn't permit this since 11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets") but that commit missed the nft_compat layer.

Scores

CVSSScoreVectorSource
3.17.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0ca743a5599199152a31a7146b83213c786c2eb2 to before 7c4f6a55a0fa8efbbe06dfed3fd440bca121f41aAffected
  • 0ca743a5599199152a31a7146b83213c786c2eb2 to before efc17b9240d821c424bc5191a5c6e9384a06293eAffected
  • 0ca743a5599199152a31a7146b83213c786c2eb2 to before b3f7a84540a0d014ec42343ff5909657c1bd1994Affected
  • 0ca743a5599199152a31a7146b83213c786c2eb2 to before 33e1875d6b5b552a2e5652b40074c604199354eeAffected
  • 0ca743a5599199152a31a7146b83213c786c2eb2 to before c129b0185e707dce405968e21afccd5728b2ce63Affected
  • 0ca743a5599199152a31a7146b83213c786c2eb2 to before 9dbba7e694ec045f21ede2f892fb42b81b4e1692Affected
LinuxLinux
  • 3.13Affected
  • before 3.13Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.145 through 6.6.*Not affected
  • 6.12.97 through 6.12.*Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.