CVE-2026-72421 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: Don't ignore error route in local/main tables.
When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables.
Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table:
# unshare -n # ip link set lo up # ip route add 192.168.0.0/24 dev lo table 253 # ip route add unreachable 192.168.0.0/24 # ip route get 192.168.0.1 192.168.0.1 dev lo table default uid 0 cache <local>
Once a random rule is added, the error route is respected:
# ip rule add table 0 # ip rule del table 0 # ip route get 192.168.0.1 RTNETLINK answers: No route to host
Let's fix the inconsistent behaviour.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the linux kernel's ipv4 forwarding information base implementation where the fib_lookup() function fails to properly handle error routes when CONFIG_IP_MULTIPLE_TABLES is enabled but no routing rules are defined. The issue occurs during route resolution when the system attempts to lookup routes across multiple tables including local and main tables, but does not correctly process error conditions from the merged local/main table. When an unreachable route is configured in the local/main table, the function continues processing and allows results from subsequent table lookups to overwrite the intended error condition, leading to inconsistent routing behavior that could be exploited by malicious actors.
The technical flaw manifests in the fib_lookup() function's handling of multiple table lookups where error routes in the local/main table are not properly terminated or prioritized. When CONFIG_IP_MULTIPLE_TABLES is enabled but no explicit rules exist, the system performs direct lookups on both the local and main tables. The current implementation fails to recognize when an error route (such as unreachable) exists in the first table lookup and continues processing, allowing subsequent table lookups to override the intended error condition with a successful route from the default table. This creates a security risk where routing decisions may be manipulated to bypass intended access controls or redirect traffic unexpectedly.
The operational impact of this vulnerability extends beyond simple routing inconsistencies to potentially enable privilege escalation or network manipulation attacks. When an attacker can craft specific routing configurations that trigger this behavior, they may be able to force the system to return incorrect routing information or bypass intended security boundaries. The vulnerability becomes particularly concerning in environments where network isolation and access control are critical, as it could allow unauthorized network access through manipulated routing decisions. This behavior violates standard security principles by creating unpredictable routing outcomes that could be exploited to bypass network security controls.
The fix for this vulnerability involves modifying the fib_lookup() function to properly terminate processing when an error route is encountered in the local/main table merge operation. The implementation should ensure that if an error condition exists in the initial table lookup, subsequent table lookups do not overwrite or override the intended error response. This aligns with security best practices for route resolution and follows the principle of least privilege by ensuring that routing decisions respect explicit error conditions rather than allowing them to be overridden by subsequent processing steps.
This vulnerability relates to CWE-254 as it represents a weakness in the implementation of access control mechanisms within the network stack, specifically in how routing errors are handled during table lookups. The inconsistent behavior could potentially enable techniques described in ATT&CK tactic TA0011 (Command and Control) by allowing attackers to manipulate routing tables for data exfiltration or command execution through compromised network paths. The fix should ensure proper error propagation and maintain consistency with established networking standards, particularly those related to routing table management and access control enforcement within kernel space operations.
The resolution requires careful attention to the order of operations in fib_lookup() where error conditions must be properly prioritized over successful route lookups. This implementation change ensures that when an unreachable or error route is explicitly defined in local or main tables, these routes take precedence over any subsequent successful lookups from other tables, maintaining the intended security posture of the routing system and preventing potential exploitation through routing manipulation attacks.