CVE-2026-72250

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter module where the nf ct frag6 reasm() function unconditionally advances the skb->mac header variable after sliding the packet head forward to drop the IPv6 fragment header. On the NF INET LOCAL OUT defrag path, if the socket buffer (skb) lacks a link-layer header, skb->mac header remains as the not-set sentinel value. Adding the size of the fragment header causes this value to wrap around to a small integer. Consequently, the skb mac header was set() function incorrectly reports that a MAC header is present, causing skb mac header() to point into the headroom of the buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.