CVE-2026-72248

A flaw was found in the Linux kernel's netfilter flowtable component. When an Internet Protocol over Internet Protocol (IPIP) tunnel is used with direct transmit (xmit), such as with a bridge device, the system fails to properly handle network packet destination entries. This improper handling can lead to a system crash in the tunnel transmit path, resulting in a Denial of Service (DoS).

A flaw in the Linux kernel's netfilter flowtable component can cause a kernel crash when IPIP tunneling is combined with flowtable offload and direct transmission, such as bridge-based forwarding. In this non-default configuration, the flowtable may fail to preserve the destination routing state (dst_entry) required by the tunnel transmit path, resulting in invalid destination handling and potential denial of service.

A remote attacker may trigger the issue by sending traffic through an already configured and reachable affected flow, without requiring local privileges. However, exploitation depends on a specific combination of IPIP tunneling, flowtable offload, and direct transmit functionality that is not enabled by default on typical Linux systems. The demonstrated impact is limited to potential system availability loss.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.