CVE-2026-72348— netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
Possible ATT&CK Techniques 1AI
T1564.008 · Email Hiding RulesAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< f16d856b6af5fd0e7cb0b0212f70825b599ef72e | affected |
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< fc416870100cf16d5b9495199355a679c3a02d48 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< f775fcf384b06f35b612f78fa5601fee99eb6513 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2fd89a50a9783eed8ed23866b11c8b3d8779a7a8 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 3578b6d92a5b1e603ae6e8c8f5538a709f03aba4 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 3d441be2b1c5e98167302fa1c7b61960a067b112 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d5e39e5eb6b30bc4a3bb7aba54c293cf36a806c7 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 43ccc20b5a733226417832cf16ef45322e594990 | affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-72348
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header length for matching. For the ah match, add the missing advertised-length check. For hbh and rt, update the existing advertised-length checks. In all three cases, set hotdrop to true before returning false when the advertised extension header length exceeds the available skb data. Returning false treats the packet as a rule mismatch. Set hotdrop to true and drop malformed packets so they cannot bypass rules intended to drop packets with these IPv6 extension headers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-72348
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72348
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-72348 (8)
Same Patch Batch · Linux · 2026-08-15 · 846 CVEs total
| CVE-2026-74309 | 10.0 CRITICAL | vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler |
| CVE-2026-74475 | 10.0 CRITICAL | vxlan: use neigh_ha_snapshot() in route_shortcircuit() |
| CVE-2026-72421 | 10.0 CRITICAL | ipv4: fib: Don't ignore error route in local/main tables. |
| CVE-2026-72408 | 10.0 CRITICAL | geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint |
| CVE-2026-74279 | 10.0 CRITICAL | crypto: cavium/cpt - fix DMA cleanup using wrong loop index |
| CVE-2026-74280 | 10.0 CRITICAL | crypto: marvell/octeontx - fix DMA cleanup using wrong loop index |
| CVE-2026-72407 | 10.0 CRITICAL | geneve: validate inner network offset in geneve_gro_complete() |
| CVE-2026-72493 | 9.9 CRITICAL | net: serialize netif_running() check in enqueue_to_backlog() |
| CVE-2026-74268 | 9.8 CRITICAL | tcp: clear sock_ops cb flags before force-closing a child socket |
| CVE-2026-72436 | 9.8 CRITICAL | netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types |
| CVE-2026-74473 | 9.8 CRITICAL | vxlan: use pskb_network_may_pull() in route_shortcircuit() |
| CVE-2026-72217 | 9.8 CRITICAL | SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing |
| CVE-2026-72065 | 9.8 CRITICAL | net: mana: Validate the packet length reported by the NIC |
| CVE-2026-72398 | 9.8 CRITICAL | sctp: add INIT verification after cookie unpacking |
| CVE-2026-74474 | 9.8 CRITICAL | vxlan: use pskb_network_may_pull() for transmit path header pulls |
| CVE-2026-72069 | 9.8 CRITICAL | locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() |
| CVE-2026-72355 | 9.8 CRITICAL | netfs: Fix barriering when walking subrequest list |
| CVE-2026-72442 | 9.8 CRITICAL | netfilter: flowtable: fix and simplify IP6IP6 tunnel handling |
| CVE-2026-74384 | 9.8 CRITICAL | nvme-multipath: fix flex array size in struct nvme_ns_head |
| CVE-2026-74267 | 9.8 CRITICAL | net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring q |
Showing top 20 of 846 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2026-72348
No comments yet