CVE-2026-72249 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: use dst in this direction when pushing IPIP header
When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple to set the IP source and destination is fine because this tuple does not provide such information to avoid storing redundant information. However, this tuple already provides the dst for this direction, this went unnoticed because this bug affects headroom and iph->frag_off only at this stage.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question relates to a flaw within the Linux kernel's netfilter subsystem, specifically within the flowtable implementation that handles IP-in-IP (IPIP) tunneling operations. This issue affects how the kernel calculates network packet headers when processing IPIP encapsulation, creating a potential vector for network manipulation and information disclosure. The problem manifests in the routing decision process where the kernel incorrectly references routing information from the opposite direction of packet flow rather than utilizing the appropriate route information for the current packet direction. According to CWE-254, this represents a weakness in the security model related to improper handling of routing contexts during network packet processing.
The technical flaw occurs during the IPIP header insertion process where the kernel computes the required headroom space needed for packet encapsulation. When calculating this headroom, the system erroneously uses routing information from the reverse direction instead of the current packet flow direction. This misapplication of routing context affects critical packet header fields including the fragment offset and overall headroom calculation. While accessing the other tuple for source and destination IP address setting is acceptable since that information is not redundant, the kernel fails to recognize that this same tuple already provides the correct destination routing information for the current direction. The vulnerability only becomes apparent during the headroom calculation phase where incorrect routing data leads to improper packet buffer allocation.
The operational impact of this vulnerability extends beyond simple packet processing errors as it can enable attackers to manipulate network traffic flow and potentially cause denial of service conditions. When the kernel incorrectly calculates headroom requirements, it may allocate insufficient buffer space for IPIP encapsulated packets, leading to packet drops or corruption during transmission. The fragment offset calculation error could also result in malformed packets that disrupt network communication or create opportunities for further exploitation. This vulnerability particularly affects systems heavily reliant on IPIP tunneling for network virtualization, VPN implementations, or traffic routing scenarios where netfilter flowtables are actively processing network packets.
Mitigation strategies should focus on implementing proper route context validation during packet header processing and ensuring that routing information is consistently referenced in the appropriate direction of packet flow. Organizations should prioritize applying kernel updates that contain the specific fix addressing the incorrect routing reference in the flowtable implementation, particularly for systems handling significant IPIP traffic. Network monitoring should be enhanced to detect anomalous packet behavior or buffer allocation issues that might indicate exploitation attempts. According to ATT&CK technique T1071.004, this vulnerability could potentially be leveraged for network protocol manipulation, making it important to maintain robust network traffic analysis capabilities and implement proper ingress/egress filtering policies to limit potential exploitation vectors through malformed packet delivery.