CVE-2026-72248 Linux CVE debrief

Who should care

Linux kernel users and administrators who utilize IPIP tunnels with direct xmit in their configurations should be aware of this vulnerability and apply patches to prevent potential issues. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review their configurations and apply patches to mitigate potential crashes in the tunnel transmit path. Affected product deployments should be identified, and owners should be assigned for follow-up and remediation efforts.

Technical summary

The Linux kernel vulnerability CVE-2026-72248 relates to the netfilter flowtable's handling of IPIP tunnels with direct xmit. The issue arises because no dst_entry is provided to check the skb headroom and set the iph->frag_off field, leading to invalid dst usage and potential crashes in the tunnel transmit path. A fix has been applied by moving dst_cache and dst_cookie out of the runtime union, allowing these to be shared by neighbour, xfrm, and direct tunnel flows. This fix ensures that dst_entry is available to the three supported xmit modes and dst_release() already deals with NULL dst.

Defensive priority

Linux kernel users should verify their configurations and apply patches to mitigate potential crashes in the tunnel transmit path.

Recommended defensive actions

• Verify Linux kernel configurations for IPIP tunnel and direct xmit usage.
• Apply patches to ensure dst_entry is properly provided for skb headroom checks and iph->frag_off field setting.
• Monitor for potential crashes in the tunnel transmit path.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE is related to a vulnerability in the Linux kernel's netfilter flowtable, specifically with IPIP tunnel and direct xmit. A fix has been implemented by moving dst_cache and dst_cookie out of the runtime union. The source grounding indicates that this is based on a patch from Rein Wei <[email protected]>. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should verify their configurations and apply patches to mitigate potential crashes in the tunnel transmit path.

Official resources