CVE-2026-72450

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability, a shift-out-of-bounds error, occurs when an unspecified address family (AF_UNSPEC) selector with a large prefix length is incorrectly matched against an IPv4 flow. An attacker could potentially exploit this by sending specially crafted network packets, leading to memory corruption and causing the system to crash, resulting in a Denial of Service (DoS).

Red Hat has rated this vulnerability as a Moderate impact because establishing the malformed transformation rules requires local network administrative capabilities (such as CAP_NET_ADMIN). In default operating environments, unprivileged users cannot manipulate IPsec security policies or states to trigger this issue. Additionally, any potential exploit is limited to causing a denial of service via a system crash, without impacting host data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.