CVE-2026-72248

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: support IPIP tunnel with direct xmit

The combination of IPIP tunnel with direct xmit, eg. bridge device,

breaks because no dst_entry is provided to check the skb headroom and to

set the iph->frag_off field. This leads to invalid dst usage and can

trigger a crash in the tunnel transmit path.

Fix this by moving dst_cache and dst_cookie out of the runtime union so

that they can be shared by neighbour, xfrm, and direct tunnel flows.

For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve

route state in these shared fields and release it through the common

dst release path.

Since dst_entry is now available to the three supported xmit modes and

dst_release() already deals with NULL dst, remove the xmit type check

in nft_flow_dst_release(). Moreover, skip the check if the dst entry

is NULL in nf_flow_dst_check() which is now the case for the direct

xmit case.

Based on patch from Rein

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References