CVE-2026-72417

netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()

Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers. While at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto and reference ctx->tun.hdr_size when updating ctx->offset.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ab427db17885814069bae891834f20842f0ac3a4 to before 025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7Affected ab427db17885814069bae891834f20842f0ac3a4 to before 84460b644329e25809b4a6d9279d6359d7fd8ebcAffected
LinuxLinux	6.19Affected before 6.19Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.