CVE-2026-72348

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter ip6tables component where malformed IPv6 extension headers could bypass rules intended to drop them. The ah, hbh, and rt matches verify the presence of the fixed extension header and use the header length field to determine the advertised extension header length. If the advertised length exceeds the available skb data (socket buffer data), the system previously treated the packet as a rule mismatch by returning false. This allowed malformed packets to bypass security rules. The fix involves setting hotdrop to true to ensure these packets are dropped immediately.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.