CVE-2026-72444

A flaw was found in the Linux kernel's flow_dissector component. When processing network packets on non-Ethernet devices, such as a TUN device in L3 mode, with specific traffic control filters, the flow_dissector can attempt to read Ethernet header information that does not exist. This leads to the use of uninitialized kernel memory as a lookup key, which could result in information disclosure or unexpected packet matching behavior.

The flow dissector can read Ethernet address fields from packets that do not have an Ethernet MAC header when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. A local attacker with control over TUN and tc flower configuration can trigger this on an L3 TUN device with a shared multiq qdisc and a flower rule matching eth_src, then send traffic through AF_PACKET. The read can consume uninitialized skb memory or in a pathological unset mac_header case read from an invalid header location, causing unpredictable classifier keys and possible kernel crash. For the CVSS the PR:L is used in the paranoid score because CAP_NET_ADMIN like control may be delegated to containers or network namespaces even when the attacker is not full host root. The issue is not directly network reachable because it depends on local device and qdisc setup. Impact is at least local denial of service and may include limited confidentiality or integrity impact through uninitialized data use in classifier lookup.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.