Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-15T00:00:00 kernel: netfilter: flowtable: support IPIP tunnel with direct xmit 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-824

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst_entry is provided to check the skb headroom and to set the iph->frag_off field. This leads to invalid dst usage and can trigger a crash in the tunnel transmit path. Fix this by moving dst_cache and dst_cookie out of the runtime union so that they can be shared by neighbour, xfrm, and direct tunnel flows. For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve route state in these shared fields and release it through the common dst release path. Since dst_entry is now available to the three supported xmit modes and dst_release() already deals with NULL dst, remove the xmit type check in nft_flow_dst_release(). Moreover, skip the check if the dst entry is NULL in nf_flow_dst_check() which is now the case for the direct xmit case. Based on patch from Rein Wei <n05ec@lzu.edu.cn>.

A flaw was found in the Linux kernel's netfilter flowtable component. When an Internet Protocol over Internet Protocol (IPIP) tunnel is used with direct transmit (xmit), such as with a bridge device, the system fails to properly handle network packet destination entries. This improper handling can lead to a system crash in the tunnel transmit path, resulting in a Denial of Service (DoS).

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-72248 https://nvd.nist.gov/vuln/detail/CVE-2026-72248 https://lore.kernel.org/linux-cve-announce/2026081552-CVE-2026-72248-7cf5@gregkh/T