CVE-2026-72442

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter flowtable regarding IP6IP6 tunnel handling. The nf flow ip6 tunnel proto() function incorrectly used skb header pointer() instead of pskb may pull(), which could prevent the outer IPv6 header from being properly placed in the skb headroom for subsequent processing. Additionally, the ctx->offset update was not properly restricted to the IPPROTO IPV6 conditional block. The receive path was simplified by removing ipv6 skip exthdr() and directly checking ip6h->nexthdr, as the flowtable fast path only supports simple IP6IP6 encapsulation without extension headers. Consequently, tunnel encapsulation limit destination option support was removed from the transmit path, and the encap limit parameter was removed from nf flow offload ipv6 forward(), nf flow tunnel ip6ip6 push(), and nf flow tunnel v6 push(), along with the ipv6 tel txoption struct.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.