CVE-2026-72249

A flaw was found in the Linux kernel's netfilter flowtable. When processing the IP-in-IP (IPIP) header, the system incorrectly uses routing information from the opposite direction to calculate packet headroom and fragmentation flags. This can lead to incorrect packet handling and potentially affect network communication.

This flaw is rated as a Moderate impact because exploiting it requires an uncommon network configuration involving netfilter flowtable offloading with IP-in-IP encapsulation, significantly restricting the attack surface in standard deployments. In typical enterprise environments, flowtable acceleration is not enabled by default, and this defect only manifests when handling encapsulated traffic where directional routing information determines packet headroom incorrectly. Older enterprise releases, including Red Hat Enterprise Linux 7, 8, and 9, do not include the affected upstream logic and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.