CVE-2026-72348

A flaw was found in the Linux kernel's netfilter subsystem, specifically within ip6tables. A remote attacker could send specially crafted IPv6 packets with malformed extension headers. Due to improper length checks, these malformed packets might not be correctly identified and dropped by ip6tables rules. This could allow an attacker to bypass intended security filtering policies.

The IPv6 iptables AH, Hop-by-Hop (HBH), and Routing Header (RT) matches use extension-header length fields when evaluating packets. When a malformed IPv6 packet advertises an extension-header length larger than the data actually available in the skb, the affected match functions can return false without setting hotdrop. Netfilter therefore treats the malformed header as a normal rule mismatch rather than an invalid packet that must be dropped. As a result, specially crafted packets may bypass ip6tables rules intended to match and drop traffic containing these IPv6 extension headers.

The vulnerable path is remotely reachable when an affected IPv6 traffic path is exposed, and no local account, local code execution, authentication, or user interaction is required. For CVSS, AV:N/AC:L/PR:N/UI:N therefore reflects the remote unauthenticated attack surface. Exploitation is limited to systems using relevant ip6tables AH, HBH, or RT extension-header match rules.

The flaw does not itself cause an out-of-bounds memory access, kernel memory corruption, information disclosure, or denial of service. Its direct security impact is a firewall policy bypass. I:L reflects the ability to circumvent an administrator-defined packet-filtering decision. Any additional confidentiality or integrity impact depends on the services and security boundaries protected by the bypassed firewall rule rather than being a direct consequence of the kernel flaw. A paranoid assessment may therefore consider limited confidentiality and integrity impact if traffic that should have been blocked can reach otherwise protected services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.