CVE-2026-72348 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header length for matching.
For the ah match, add the missing advertised-length check. For hbh and rt, update the existing advertised-length checks. In all three cases, set hotdrop to true before returning false when the advertised extension header length exceeds the available skb data.
Returning false treats the packet as a rule mismatch. Set hotdrop to true and drop malformed packets so they cannot bypass rules intended to drop packets with these IPv6 extension headers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's netfilter subsystem, specifically affecting the ip6tables implementation for IPv6 packet processing. The issue involves three critical IPv6 extension header types: Authentication Header (AH), Hop-by-Hop Options (HBH), and Routing Headers (RT). These headers are fundamental components of IPv6 networking that provide additional functionality such as security features, routing information, and hop-by-hop options. The vulnerability stems from inadequate validation of extension header length fields within the packet processing logic, creating a potential bypass mechanism for maliciously crafted packets.
The technical flaw manifests in how the kernel handles the advertised length field present in each IPv6 extension header type. When processing these headers, the system first verifies that the fixed portion of the extension header exists, but fails to properly validate whether the advertised length field accurately reflects the actual data available in the packet buffer. This validation gap allows attackers to craft packets with malformed extension headers where the length field indicates more data than actually exists in the packet payload. The ah match function specifically lacked the check for advertised-length validation, while the hbh and rt matches had incomplete implementations that needed updates.
The operational impact of this vulnerability is significant for network security systems relying on ip6tables rules to filter IPv6 traffic containing specific extension headers. When malformed extension headers exceed available packet data, the kernel's current behavior treats these packets as rule mismatches rather than dropping them outright. This creates a bypass opportunity where malicious packets with oversized extension header length fields can evade security policies intended to drop such packets. The hotdrop mechanism, when properly implemented, ensures that malformed packets are immediately dropped without being processed further, preventing potential exploitation or bypass of security controls. Without this proper handling, attackers could craft packets designed to exploit the length validation gap and potentially bypass network filtering rules.
The solution involves implementing comprehensive advertised-length checks for all three extension header types and ensuring that when these checks fail, the system sets hotdrop to true before returning false. This change ensures that malformed packets with invalid extension header lengths are dropped immediately rather than treated as rule mismatches. The fix aligns with security best practices for network protocol handling and follows established patterns for dealing with malformed packet data in kernel space. This vulnerability demonstrates the importance of proper input validation in kernel networking code and highlights how seemingly minor gaps in length checking can create significant security implications.
This issue relates to CWE-129, which covers improper validation of array index or buffer length, and addresses the broader category of protocol handling vulnerabilities in network stack implementations. The ATT&CK framework would classify this under T1562.007 for Defense Evasion through Protocol Impairment, where attackers could exploit malformed headers to bypass security controls. The fix represents a defensive programming approach that prioritizes packet integrity validation over graceful degradation when encountering malformed data, which is essential for maintaining network security boundaries and preventing potential exploitation of protocol parsing vulnerabilities in kernel space.