CVE-2026-72450
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel's xfrm module, xfrm_selector_match() can perform a shift-out-of-bounds for an AF_UNSPEC selector with a large prefixlen. The fix adds validation of families and prefix lengths.
Risk Assessment
The bug can lead to system crash or incorrect IPsec packet processing.
Recommendation
Install the updated Linux kernel with the fix validating xfrm selectors.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: - Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).