CVE-2026-72417

A flaw was found in the Linux kernel's netfilter flowtable component. Insufficient validation of the iph->ihl field in the nf_flow_ip4_tunnel_proto() function, when processing malformed IP (Internet Protocol) headers, could lead to an out-of-bounds access. This vulnerability could allow a remote attacker to trigger memory corruption.

This vulnerability is rated as Moderate severity rather than Important because netfilter flowtables are not enabled by default in Red Hat Enterprise Linux and require explicit administrator configuration of flowtable offloading in nftables. The issue is only reachable when a system is actively routing IPv4 encapsulated tunnel traffic through an accelerated flowtable path. Furthermore, the vulnerable code was introduced in recent upstream kernels and is not present in most supported Red Hat Enterprise Linux releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.