SB20260815272 - Improper input validation in Linux kernel net netfilter

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-72442)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in nf_flow_ip6_tunnel_proto() in the netfilter flowtable IPv6 tunnel handling code when processing IPv6-in-IPv6 encapsulated packets. A remote attacker can send specially crafted IPv6 tunnel traffic to cause a denial of service.

The issue arises because the fast path does not handle IPv6 extension headers in this encapsulation case.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7f8d816a9aa2729d270418f00c9ef5e85bfc1b31
• https://git.kernel.org/stable/c/f4c2d8668d85ed125985da663c824a9c25498257