CVE-2026-72254
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In the Linux kernel, the nft_fib netfilter module has a NULL pointer dereference vulnerability when a fib expression is used in a netdev egress base chain. Validation incorrectly accepts the egress hook, leading to a system crash.
Risk Assessment
An attacker can cause a system crash (kernel panic) by configuring netfilter rules with a fib expression in an egress chain, resulting in denial of service.
Recommendation
Apply a Linux kernel update containing the fix that adds proper validation for netdev hooks in nft_fib.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nft_in(pkt), NULL on the transmit path, causing a NULL pointer dereference at eval. nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook numbers are a separate enum that aliases them (NF_NETDEV_EGRESS == NF_INET_LOCAL_IN), so an egress chain passes validation and then faults. Add nft_fib_netdev_validate() that limits each result/flag to the netdev hook where the device it reads exists: the input-device cases (OIF, OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are not applied to another family's hooks.