CVE-2026-72250

A flaw was found in the Linux kernel's nf_conntrack_reasm module, specifically within the IPv6 defragmentation process. An attacker could exploit this by sending specially crafted IPv6 fragmented packets. The nf_ct_frag6_reasm() function incorrectly adjusts the mac_header offset, causing the system to wrongly identify a MAC header and point to an invalid memory location. This can lead to information disclosure, where sensitive data from kernel memory might be exposed, or a denial of service (DoS), which could make the system unavailable.

This vulnerability is rated as Moderate impact because exploitation is restricted to locally originated network traffic and primarily leads to a system crash rather than arbitrary privilege escalation. Under default Red Hat Enterprise Linux deployments, connection tracking evaluates outbound packets where link-layer headers have not yet been assigned. When processing fragmented IPv6 packets on this local output path, the reassembly logic inappropriately advances the link-layer offset sentinel, corrupting packet metadata. Subsequent kernel handling of the corrupted buffer causes an invalid memory reference that induces a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.