CVE-2026-72250 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

🗓️ 15 Aug 2026 05:54:39Reported by GoogleType

osv

osv🔗 osv.dev👁 7 Views

Unconditional mac_header add in nf_ct_frag6_reasm wraps sentinel to small value on LOCAL_OUT path.

Source	Link
git	www.git.kernel.org/stable/c/00bdce2fda7e430d24cfbc96764a1b96deb31f82
git	www.git.kernel.org/stable/c/2a95ec21824a8ad81ad660b12231456fc0ac9830
git	www.git.kernel.org/stable/c/3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9
git	www.git.kernel.org/stable/c/53ef70a315420ed31581d38343684b3bf9a3c76d
git	www.git.kernel.org/stable/c/6e8cd710ca35c576f5f2e5a396047c9ac61f75e5
git	www.git.kernel.org/stable/c/a58230f3a7c4f6c3261786bc1efb72c42e68cd25
git	www.git.kernel.org/stable/c/bbcdef2061b170af45702ce6b359c02c12acfc94
git	www.git.kernel.org/stable/c/cd0d7bbc027b4d3329712cdcdeb4e5567ffd0d58
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72250.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-72250

18 Aug 2026 03:56Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.8

Linux kernel nf_conntrack_reasm IPv6 fragmentation mac_header overflow skb_mac_header_was_set local_out path