CVE-2026-72450

xfrm: validate selector family and prefixlen during match

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).

Fix this by:

- Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 to before 87a5bbccc7ff4edb3f42fea387124237d2ba91eeAffected 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 to before bd7f202cf77556cff59f68dc30e4cdf40cb6e33bAffected bce1afaa212ec380bf971614f70909a27882b862 to before a3968ad4195d72c8fddcc6c0ef39da95ac98711aAffected 7d9868180bd1e4cf37e7c5067362658971162366 to before efa9e3b9f3dea2e1ea4c7edf4edc863faef85986Affected 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 78783fefdc8f36879b1a17efa0d3195ea5f2dc5fAffected 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfeAffected 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 5a03a2ee17e8259dde631ed84fd8322db06cb2aeAffected 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 40f0b1047918539f0b0f795ac65e35336b4c2c78Affected f31398570acf0f0804c644006f7bfa9067106b0aAffected 401ad99a5ae7180dd9449eac104cb755f442e7f3Affected e68dd80ba498265d2266b12dc3459164f4ff0c4aAffected 5.10.229 to before 5.10.261Affected 5.15.170 to before 5.15.212Affected 6.1.115 to before 6.1.178Affected 6.6.59 to before 6.6.145Affected 4.19.323 to before 4.20Affected 5.4.285 to before 5.5Affected 6.11.6 to before 6.12Affected
LinuxLinux	6.12Affected before 6.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 to before 87a5bbccc7ff4edb3f42fea387124237d2ba91eeAffected
2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 to before bd7f202cf77556cff59f68dc30e4cdf40cb6e33bAffected
bce1afaa212ec380bf971614f70909a27882b862 to before a3968ad4195d72c8fddcc6c0ef39da95ac98711aAffected
7d9868180bd1e4cf37e7c5067362658971162366 to before efa9e3b9f3dea2e1ea4c7edf4edc863faef85986Affected
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 78783fefdc8f36879b1a17efa0d3195ea5f2dc5fAffected
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfeAffected
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 5a03a2ee17e8259dde631ed84fd8322db06cb2aeAffected
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 to before 40f0b1047918539f0b0f795ac65e35336b4c2c78Affected
f31398570acf0f0804c644006f7bfa9067106b0aAffected
401ad99a5ae7180dd9449eac104cb755f442e7f3Affected
e68dd80ba498265d2266b12dc3459164f4ff0c4aAffected
5.10.229 to before 5.10.261Affected
5.15.170 to before 5.15.212Affected
6.1.115 to before 6.1.178Affected
6.6.59 to before 6.6.145Affected
4.19.323 to before 4.20Affected
5.4.285 to before 5.5Affected
6.11.6 to before 6.12Affected

LinuxLinux

6.12Affected
before 6.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.