CVE-2026-72442

A flaw was found in the Linux kernel's netfilter flowtable, which manages network packet processing. The system incorrectly handled IPv6-in-IPv6 (IP6IP6) tunneled packets, specifically in how it processed the outer IPv6 header. This could lead to improper network traffic management, potentially causing disruptions in network services.

This vulnerability is rated Moderate rather than Important because exploitation requires a specialized routing configuration that is not enabled by default, specifically involving netfilter flowtable offload for IPv6-in-IPv6 tunnels. In typical Red Hat Enterprise Linux deployments, netfilter flowtables are inactive unless explicitly defined and configured in the firewall ruleset. In scenarios where flowtable offloading handles such encapsulated traffic, malformed outer headers can trigger an out-of-bounds read, potentially resulting in a kernel crash and local system denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.