CVE-2026-72417
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the Linux kernel netfilter flowtable, the function nf_flow_ip4_tunnel_proto() does not validate the iph->ihl field before using it to compute the header size, which can lead to out-of-bounds access with malformed IP headers. The fix adds a sanity check for the ihl field and uses iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto, and references ctx->tun.hdr_size when updating ctx->offset.
Risk Assessment
This may lead to out-of-bounds memory read, potentially causing information disclosure or system crash.
Recommendation
Update the Linux kernel to a version with the fix, and monitor network traffic for malicious IP packets.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers. While at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto and reference ctx->tun.hdr_size when updating ctx->offset.