CVE-2026-72256

A flaw was found in the Linux kernel. The xt_cluster module, specifically within the xt_cluster_mt() function, incorrectly processes template connection tracking (conntrack) objects. This state confusion occurs when a template conntrack is attached before it is fully initialized, leading to xt_cluster_hash() attempting to hash incomplete conntrack state. This can cause the system to trigger a WARN_ON() condition, potentially resulting in a denial of service.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires specific netfilter clustering rules to be configured alongside raw connection tracking templates, limiting the blast radius to a localized denial of service. Under default configurations, the xt_cluster netfilter extension is not utilized by standard firewall setups. Triggering the issue requires elevated privileges such as CAP_NET_ADMIN or unprivileged user namespace capabilities to manipulate packet filtering tables, preventing unauthenticated remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.