Linux Kernel up to 7.1.4/7.2-rc2 flowtable nft_flow_dst_release buffer overflow

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.1.4/7.2-rc2 and classified as critical. This impacts the function nft_flow_dst_release of the component flowtable. The manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2026-72248. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.1.4/7.2-rc2. This issue affects the function nft_flow_dst_release of the component flowtable. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst_entry is provided to check the skb headroom and to set the iph->frag_off field. This leads to invalid dst usage and can trigger a crash in the tunnel transmit path. Fix this by moving dst_cache and dst_cookie out of the runtime union so that they can be shared by neighbour, xfrm, and direct tunnel flows. For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve route state in these shared fields and release it through the common dst release path. Since dst_entry is now available to the three supported xmit modes and dst_release() already deals with NULL dst, remove the xmit type check in nft_flow_dst_release(). Moreover, skip the check if the dst entry is NULL in nf_flow_dst_check() which is now the case for the direct xmit case. Based on patch from Rein Wei <[email protected]>.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-72248 since 08/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/15/2026).

Upgrading to version 7.1.5 or 7.2-rc3 eliminates this vulnerability. Applying the patch 0880c4ed122d0cddc9f29a2b28f055d1f24f0fca/fa7395c02d95e51bad2952325d2d6503bfbad437 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.2-rc1
• 7.2-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion