CVE-2026-72442: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: fix and simplify IP6IP6 tunnel handling

Fix nfflowip6tunnelproto() to use pskbmaypull() instead of skbheaderpointer() to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet processing. Move ctx->offset update inside the IPPROTOIPV6 conditional block since it should only be adjusted when an IP6IP6 tunnel is actually detected. Simplify the rx path by removing ipv6skipexthdr() and checking ip6h->nexthdr directly, as the flowtable fast path only handles simple IP6IP6 encapsulation without extension headers. Drop the tunnel encapsulation limit destination option support from the tx path to match, since the rx path no longer handles extension headers. Remove the encaplimit parameter from nfflowoffloadipv6forward(), nfflowtunnelip6ip6push() and nfflowtunnelv6push(), along with the ipv6teltxoption struct and related headroom/MTU adjustments.

Affected Software

126 affected componentsFixes available
Linux Linux kernel
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17*
ubuntu/linux-aws-7.0<7.0.0-1013.13~24.04.1
7.0.0-1013.13~24.04.1
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17*
ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1
7.0.0-1017.17~24.04.1
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17*
ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1
7.0.0-1016.16~24.04.1
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-7.0<7.0.0-1013.13~24.04.1
7.0.0-1013.13~24.04.1
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-7.0<7.0.0-34.34~24.04.1
7.0.0-34.34~24.04.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-7.0<7.0.0-1024.25~24.04.1
7.0.0-1024.25~24.04.1
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-7.0<7.0.0-1012.12~24.04.1
7.0.0-1012.12~24.04.1
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17*
ubuntu/linux-riscv-7.0<7.0.0-34.34.1~24.04.1
7.0.0-34.34.1~24.04.1
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17*
ubuntu/linux<7.0.0-34.34
7.0.0-34.34
ubuntu/linux-aws<7.0.0-1013.13
7.0.0-1013.13
ubuntu/linux-azure<7.0.0-1017.17
7.0.0-1017.17
ubuntu/linux-azure-fde<7.0.0-1016.16
7.0.0-1016.16
ubuntu/linux-gcp<7.0.0-1013.13
7.0.0-1013.13
ubuntu/linux-gke<7.0.0-1007.8
7.0.0-1007.8
ubuntu/linux-ibm<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-bos<7.0.0-2022.23
7.0.0-2022.23
ubuntu/linux-oem-7.0<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-oracle<7.0.0-1012.12
7.0.0-1012.12
ubuntu/linux-raspi<7.0.0-1020.20
7.0.0-1020.20
ubuntu/linux-realtime<7.0.0-34.34.1
7.0.0-34.34.1
ubuntu/linux-riscv<7.0.0-34.34.1
7.0.0-34.34.1
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13~24.04.1
  2. Upgrade

    Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17~24.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16~24.04.1
  4. Upgrade

    Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13~24.04.1
  5. Upgrade

    Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34~24.04.1
  6. Upgrade

    Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1024.25~24.04.1
  7. Upgrade

    Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1012.12~24.04.1
  8. Upgrade

    Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34.1~24.04.1
  9. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34
  10. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13
  11. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17
  12. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16
  13. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13
  14. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 7.0.0-1007.8
  15. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  16. Upgrade

    Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.

    Fixed in 7.0.0-2022.23
  17. Upgrade

    Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  18. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.0.0-1012.12
  19. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 7.0.0-1020.20
  20. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34.1
  21. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34.1
  22. Compensating control

    Update netfilter flowtable IP6IP6 tunnel handling: make nf_flow_ip6_tunnel_proto() use pskb_may_pull() instead of skb_header_pointer(); update ctx->offset only inside the IPPROTO_IPV6 conditional; remove the encap_limit parameter from nf_flow_offload_ipv6_forward(), nf_flow_tunnel_ip6ip6_push(), and nf_flow_tunnel_v6_push(), along with ipv6_tel_txoption and related headroom/MTU adjustments; and have the RX path check ip6h->nexthdr directly without ipv6_skip_exthdr(), supporting only simple IP6IP6 encapsulation without extension headers.

Event History

Aug 15, 2026
CVE Published
via MITRE·05:56 AM
Data Sourced
via MITRE·05:56 AM
DescriptionSeverity
Data Sourced
via OSV·06:22 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·06:22 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2026-72442?

The severity of CVE-2026-72442 is rated as risk level 37.

2

How do I fix CVE-2026-72442?

To fix CVE-2026-72442, update your Linux kernel to the latest version that includes the patch resolving this vulnerability.

3

What type of system is affected by CVE-2026-72442?

CVE-2026-72442 affects the Linux kernel's netfilter flowtable handling for IP6IP6 tunnels.

4

What does CVE-2026-72442 specifically address?

CVE-2026-72442 addresses an issue in the nf_flow_ip6_tunnel_proto() function related to proper handling of the outer IPv6 header.

5

When was CVE-2026-72442 published?

CVE-2026-72442 was published on August 15, 2026.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203