CVE-2026-72429 Linux CVE debrief

Who should care

Users of the Linux kernel, system administrators, and security teams should verify their kernel versions and update if necessary. They should also monitor for potential invalid pointer access and review system configurations to apply compensating controls if necessary. Affected operators, platforms, vulnerability-management, and security teams should take note of the vulnerability and its potential impact.

Technical summary

The vulnerability is caused by a type confusion of dst_entry in the IPv6 IOAM. IOAM uses a dummy dst_entry(null_dst) which is stored in the IOAM lwt state and may be passed to dst_cache_set_ip6(). However, the IPv6 dst cache path eventually calls rt6_get_cookie(), which treats the dst_entry as part of a struct rt6_info. This results in an invalid cast and rt6_get_cookie() reading fields from the wrong object. The fix is to embed a full struct rt6_info for the dummy IPv6 route and pass its dst member to the dst APIs.

Defensive priority

This vulnerability affects the Linux kernel and may allow for potential invalid pointer access. Users should verify their kernel versions and update if necessary.

Recommended defensive actions

• Verify kernel versions and update if necessary
• Monitor for potential invalid pointer access
• Review system configurations and apply compensating controls if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by a type confusion of dst_entry in the IPv6 IOAM. IOAM uses a dummy dst_entry(null_dst) which is stored in the IOAM lwt state and may be passed to dst_cache_set_ip6(). However, the IPv6 dst cache path eventually calls rt6_get_cookie(), which treats the dst_entry as part of a struct rt6_info. This results in an invalid cast and rt6_get_cookie() reading fields from the wrong object.

Official resources