Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-72250— netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于nf_ct_frag6_reasm函数在IPv6分片重组后对skb->mac_header进行无条件调整，导致mac_header未设置状态被破坏，可能使skb_mac_header_was_set错误判断并导致内核数据包处理异常。

CVSS 7.8 · High EPSS 0.16% · P6

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< 6e8cd710ca35c576f5f2e5a396047c9ac61f75e5 affected
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< 2a95ec21824a8ad81ad660b12231456fc0ac9830 affected
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< bbcdef2061b170af45702ce6b359c02c12acfc94 affected
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< cd0d7bbc027b4d3329712cdcdeb4e5567ffd0d58 affected
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< 53ef70a315420ed31581d38343684b3bf9a3c76d affected
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< a58230f3a7c4f6c3261786bc1efb72c42e68cd25 affected
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< 00bdce2fda7e430d24cfbc96764a1b96deb31f82 affected
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1< 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72250

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb->mac_header: skb->mac_header += sizeof(struct frag_hdr); On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7), after which skb_mac_header_was_set() wrongly reports a MAC header is present and skb_mac_header() points into the headroom. The reassembler has done this unconditional add since it was introduced; it was harmless while mac_header was a bare pointer, but wrong once mac_header became a u16 offset whose unset state is the ~0U sentinel tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c does the same relocation and does guard the adjustment; mirror the guard here.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于nf_ct_frag6_reasm函数在IPv6分片重组后对skb->mac_header进行无条件调整，导致mac_header未设置状态被破坏，可能使skb_mac_header_was_set错误判断并导致内核数据包处理异常。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 ~ 6e8cd710ca35c576f5f2e5a396047c9ac61f75e5 -
Linux Linux 2.6.15 -

II. Public POCs for CVE-2026-72250

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72250

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72250 (8)

Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total

CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-74376 9.8 CRITICAL md/raid10: reset read_slot when reusing r10bio for discard
CVE-2026-74433 9.8 CRITICAL rxrpc: Fix UAF in rxgk_issue_challenge()
CVE-2026-74434 9.8 CRITICAL rxrpc: Don't move a peeked OOB message onto the pending queue
CVE-2026-72191 9.8 CRITICAL ntfs3: validate split-point offset in indx_insert_into_buffer
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-72398 9.8 CRITICAL sctp: add INIT verification after cookie unpacking
CVE-2026-74384 9.8 CRITICAL nvme-multipath: fix flex array size in struct nvme_ns_head
CVE-2026-72442 9.8 CRITICAL netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
CVE-2026-74436 9.8 CRITICAL rxrpc: serialize kernel accept preallocation with socket teardown
CVE-2026-74545 9.8 CRITICAL rtase: fix double free of multi-frag skb on DMA map failure
CVE-2026-72046 9.8 CRITICAL gve: fix header buffer corruption with header-split and HW-GRO
CVE-2026-72473 9.8 CRITICAL xprtrdma: Decouple req recycling from RPC completion

Showing top 20 of 845 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72250

No comments yet

Leave a comment