CVE-2026-72444

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

flow_dissector: check device type before reading ETH_ADDRS

__skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb)

when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb

has a valid Ethernet header at mac_header, which is not always the case.

The problem can be triggered by:

1. Creating a TUN device in L3 mode (IFF_TUN, hard_header_len=0)

2. Attaching a multiq qdisc with a flower filter matching on eth_src

3. Sending a packet through AF_PACKET

Since TUN in L3 mode has no link-layer header, mac_header points to

the L3 data area. The flow dissector reads 12 bytes of uninitialized

skb memory, which then propagates through fl_set_masked_key() and is

used as a rhashtable lookup key in __fl_lookup(), as reported by KMSAN.

Rejecting the filter in the control path (at tc filter add time) is

not feasible because TC filter blocks can be shared between arbitrary

devices -- a filter installed on

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References