Vulnerability-Lookup

BDU:2026-16926 (CVE-2026-72450)

Vulnerability from fstec – Published: 2026-10-20 – Updated: 2026-10-20 – View on bdu.fstec.ru Fixed

Title

Уязвимость компонентов net/xfrm/xfrm_policy.c и include/net/xfrm.h ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость компонентов net/xfrm/xfrm_policy.c и include/net/xfrm.h ядра операционной системы Linux связана с некорректным вычислением. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

7.8 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-682 - Неверные вычисления

Aliases

CVE-2026-72450, GHSA-J58F-WQFC-2RV4

References

16 references

URL
https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78
https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae
https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe
https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f
https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee
https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a
https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b
https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986
https://github.com/advisories/GHSA-j58f-wqfc-2rv4
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/aarch64/updates/
https://security-tracker.debian.org/tracker/CVE-2026-72450
https://deb.freexian.com/extended-lts/tracker/CVE-2026-72450
https://access.redhat.com/security/cve/CVE-2026-72450
https://ubuntu.com/security/CVE-2026-72450

Impacted products

5 products from 5 vendors

Vendors

Canonical Ltd., Сообщество свободного программного обеспечения, Red Hat, Inc., ООО «Ред Софт»

Products

Ubuntu, Debian GNU/Linux, Red Hat Enterprise Linux, РЕД ОС (запись в едином реестре российских программ №3751), Linux

Versions

16.04 LTS (Ubuntu), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (РЕД ОС), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 10 (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (РЕД ОС), 26.04 LTS (Ubuntu), от 6.13 до 6.18.40 (Linux), от 6.19 до 7.1.5 (Linux), от 4.19.323 до 4.19.325 включительно (Linux), от 5.4.285 до 5.4.302 включительно (Linux), от 5.10.229 до 5.10.261 (Linux), от 5.15.170 до 5.15.212 (Linux), от 6.1.115 до 6.1.178 (Linux), от 6.6.59 до 6.6.145 (Linux), от 6.11.6 до 6.12.97 (Linux)

Product types

Operating system

Platforms

Canonical Ltd. Ubuntu 16.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 9, Canonical Ltd. Ubuntu 18.04 LTS, Red Hat, Inc. Red Hat Enterprise Linux 8, Сообщество свободного программного обеспечения Debian GNU/Linux 10, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751), Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, Canonical Ltd. Ubuntu 24.04 LTS, Inc. Red Hat Enterprise Linux 10, Сообщество свободного программного обеспечения Debian GNU/Linux 13, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751), Canonical Ltd. Ubuntu 26.04 LTS, Сообщество свободного программного обеспечения Linux от 6.13 до 6.18.40, Сообщество свободного программного обеспечения Linux от 6.19 до 7.1.5, Сообщество свободного программного обеспечения Linux от 4.19.323 до 4.19.325 включительно, Сообщество свободного программного обеспечения Linux от 5.4.285 до 5.4.302 включительно, Сообщество свободного программного обеспечения Linux от 5.10.229 до 5.10.261, Сообщество свободного программного обеспечения Linux от 5.15.170 до 5.15.212, Сообщество свободного программного обеспечения Linux от 6.1.115 до 6.1.178, Сообщество свободного программного обеспечения Linux от 6.6.59 до 6.6.145, Сообщество свободного программного обеспечения Linux от 6.11.6 до 6.12.97

Mitigations

Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78 https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986 Для Ред ОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ http://repo.red-soft.ru/redos/8.0/x86_64/updates/ http://repo.red-soft.ru/redos/8.0/aarch64/updates/ Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2026-72450 https://deb.freexian.com/extended-lts/tracker/CVE-2026-72450 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/CVE-2026-72450 Для Ubuntu: https://ubuntu.com/security/CVE-2026-72450

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Red Hat, Inc., \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "16.04 LTS (Ubuntu), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 10 (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (\u0420\u0415\u0414 \u041e\u0421), 26.04 LTS (Ubuntu), \u043e\u0442 6.13 \u0434\u043e 6.18.40 (Linux), \u043e\u0442 6.19 \u0434\u043e 7.1.5 (Linux), \u043e\u0442 4.19.323 \u0434\u043e 4.19.325 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.4.285 \u0434\u043e 5.4.302 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.10.229 \u0434\u043e 5.10.261 (Linux), \u043e\u0442 5.15.170 \u0434\u043e 5.15.212 (Linux), \u043e\u0442 6.1.115 \u0434\u043e 6.1.178 (Linux), \u043e\u0442 6.6.59 \u0434\u043e 6.6.145 (Linux), \u043e\u0442 6.11.6 \u0434\u043e 6.12.97 (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78\nhttps://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae\nhttps://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe\nhttps://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f\nhttps://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee\nhttps://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a\nhttps://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b\nhttps://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421:\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-72450\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-72450\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/CVE-2026-72450\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-72450",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "15.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "20.10.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-16926",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-72450, GHSA-J58F-WQFC-2RV4",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Debian GNU/Linux, Red Hat Enterprise Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 16.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , Canonical Ltd. Ubuntu 18.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 10 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Canonical Ltd. Ubuntu 26.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.13 \u0434\u043e 6.18.40 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.19 \u0434\u043e 7.1.5 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.19.323 \u0434\u043e 4.19.325 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.4.285 \u0434\u043e 5.4.302 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.10.229 \u0434\u043e 5.10.261 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.15.170 \u0434\u043e 5.15.212 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.1.115 \u0434\u043e 6.1.178 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.6.59 \u0434\u043e 6.6.145 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.11.6 \u0434\u043e 6.12.97 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 net/xfrm/xfrm_policy.c \u0438 include/net/xfrm.h \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u044b\u0435 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f (CWE-682)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 net/xfrm/xfrm_policy.c \u0438 include/net/xfrm.h \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78\nhttps://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae\nhttps://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe\nhttps://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f\nhttps://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee\nhttps://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a\nhttps://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b\nhttps://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986\nhttps://github.com/advisories/GHSA-j58f-wqfc-2rv4\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\nhttps://security-tracker.debian.org/tracker/CVE-2026-72450\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-72450\nhttps://access.redhat.com/security/cve/CVE-2026-72450\nhttps://ubuntu.com/security/CVE-2026-72450",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-682",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}

CVE-2026-72450 (GCVE-0-2026-72450)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-10-16 18:55

Title

xfrm: validate selector family and prefixlen during match

Summary

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: - Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:50 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/87a5bbccc7ff4edb3…
https://git.kernel.org/stable/c/bd7f202cf77556cff…
https://git.kernel.org/stable/c/a3968ad4195d72c8f…
https://git.kernel.org/stable/c/efa9e3b9f3dea2e1e…
https://git.kernel.org/stable/c/78783fefdc8f36879…
https://git.kernel.org/stable/c/6d99379c58f7f1c6a…
https://git.kernel.org/stable/c/5a03a2ee17e8259dd…
https://git.kernel.org/stable/c/40f0b1047918539f0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 , < 87a5bbccc7ff4edb3f42fea387124237d2ba91ee (git) Affected: 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 , < bd7f202cf77556cff59f68dc30e4cdf40cb6e33b (git) Affected: bce1afaa212ec380bf971614f70909a27882b862 , < a3968ad4195d72c8fddcc6c0ef39da95ac98711a (git) Affected: 7d9868180bd1e4cf37e7c5067362658971162366 , < efa9e3b9f3dea2e1ea4c7edf4edc863faef85986 (git) Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 78783fefdc8f36879b1a17efa0d3195ea5f2dc5f (git) Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe (git) Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 5a03a2ee17e8259dde631ed84fd8322db06cb2ae (git) Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 40f0b1047918539f0b0f795ac65e35336b4c2c78 (git) Affected: f31398570acf0f0804c644006f7bfa9067106b0a (git) Affected: 401ad99a5ae7180dd9449eac104cb755f442e7f3 (git) Affected: e68dd80ba498265d2266b12dc3459164f4ff0c4a (git) Affected: 5.10.229 , < 5.10.261 (semver) Affected: 5.15.170 , < 5.15.212 (semver) Affected: 6.1.115 , < 6.1.178 (semver) Affected: 6.6.59 , < 6.6.145 (semver) Affected: 4.19.323 , < 4.20 (semver) Affected: 5.4.285 , < 5.5 (semver) Affected: 6.11.6 , < 6.12 (semver)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:50:15.343640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:24.828Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87a5bbccc7ff4edb3f42fea387124237d2ba91ee",
              "status": "affected",
              "version": "8df5cd51fd70c33aa1776e5cbcd82b0a86649d73",
              "versionType": "git"
            },
            {
              "lessThan": "bd7f202cf77556cff59f68dc30e4cdf40cb6e33b",
              "status": "affected",
              "version": "2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71",
              "versionType": "git"
            },
            {
              "lessThan": "a3968ad4195d72c8fddcc6c0ef39da95ac98711a",
              "status": "affected",
              "version": "bce1afaa212ec380bf971614f70909a27882b862",
              "versionType": "git"
            },
            {
              "lessThan": "efa9e3b9f3dea2e1ea4c7edf4edc863faef85986",
              "status": "affected",
              "version": "7d9868180bd1e4cf37e7c5067362658971162366",
              "versionType": "git"
            },
            {
              "lessThan": "78783fefdc8f36879b1a17efa0d3195ea5f2dc5f",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "lessThan": "6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "lessThan": "5a03a2ee17e8259dde631ed84fd8322db06cb2ae",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "lessThan": "40f0b1047918539f0b0f795ac65e35336b4c2c78",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f31398570acf0f0804c644006f7bfa9067106b0a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "401ad99a5ae7180dd9449eac104cb755f442e7f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e68dd80ba498265d2266b12dc3459164f4ff0c4a",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.229",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.170",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.115",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.229",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.170",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.115",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.323",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.285",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: validate selector family and prefixlen during match\n\nsyzbot reported a shift-out-of-bounds in xfrm_selector_match()\ndue to AF_UNSPEC selector with large prefixlen (e.g. 128) matched\nagainst IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).\n\nFix this by:\n\n- Rejecting mismatched families in xfrm_selector_match.\n- Returning false in addr4_match if prefixlen \u003e 32.\n- Returning false in addr_match if prefixlen \u003e 128 (prevents overflow)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is armed via NETLINK_XFRM (XFRM_MSG_NEWSA with XFRM_STATE_AF_UNSPEC) in xfrm_user_rcv_msg(), and per kernel CNA guidance xfrm/netlink configuration is Local even though xfrm_selector_match() is later hit from IPv4/IPv6 packet processing in __xfrm_policy_check() and xfrm_state_look_at().\nAC:L - The attacker fully controls the malformed SA selector (AF_UNSPEC with prefixlen up to 255) and can deterministically trigger matching by sending or receiving IPv4/IPv6 traffic through xfrm; no race, victim state, or memory layout outside attacker control is required.\nPR:L - xfrm_user_rcv_msg() requires netlink_net_capable(CAP_NET_ADMIN), evaluated against the socket net namespace user_ns via ns_capable(); an unprivileged local user obtains CAP_NET_ADMIN with unshare -Urn and can install the poisoned SA and matching policy in that namespace.\nUI:N - The attacker performs the entire sequence\u2014installing the XFRM SA/policy over netlink and generating matching traffic\u2014with no action required from any other user, administrator, or victim.\nS:U - The shift-out-of-bounds and out-of-bounds memcmp reads occur entirely within kernel xfrm selector matching on the same host; no VM escape, IOMMU bypass, or cross-security-authority boundary is crossed.\nC:H - addr4_match() performs an undefined left-shift when prefixlen\u003e32 on IPv4 flows, and addr_match() can memcmp() up to (prefixlen\u003e\u003e5)\u003c\u003c2 bytes past 16-byte selector/flow addresses when prefixlen\u003e128 on IPv6, leaking adjacent kernel memory per CNA OOB-read guidance.\nI:H - C11 undefined-behavior shifts in hot-path packet classification and unchecked prefix comparisons can corrupt mask/offset arithmetic and selector-match control flow, giving attacker-influenced kernel behavior exploitable for integrity compromise per CNA memory-unsafe-operation guidance.\nA:H - syzbot reproduced UBSAN shift-out-of-bounds in xfrm_selector_match(), and undefined shifts plus out-of-bounds reads in the xfrm input/policy-check path can provoke kernel oops/panic (especially with panic_on_warn/KASAN), satisfying CNA guidance that kernel crashes are High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:19.730Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a"
        },
        {
          "url": "https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986"
        },
        {
          "url": "https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78"
        }
      ],
      "title": "xfrm: validate selector family and prefixlen during match",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72450",
    "datePublished": "2026-08-15T05:56:58.939Z",
    "dateReserved": "2026-08-09T03:40:39.931Z",
    "dateUpdated": "2026-10-16T18:55:24.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-J58F-WQFC-2RV4

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).

Fix this by:

Rejecting mismatched families in xfrm_selector_match.
Returning false in addr4_match if prefixlen > 32.
Returning false in addr_match if prefixlen > 128 (prevents overflow).

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72450"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:18Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: validate selector family and prefixlen during match\n\nsyzbot reported a shift-out-of-bounds in xfrm_selector_match()\ndue to AF_UNSPEC selector with large prefixlen (e.g. 128) matched\nagainst IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).\n\nFix this by:\n\n- Rejecting mismatched families in xfrm_selector_match.\n- Returning false in addr4_match if prefixlen \u003e 32.\n- Returning false in addr_match if prefixlen \u003e 128 (prevents overflow).",
  "id": "GHSA-j58f-wqfc-2rv4",
  "modified": "2026-08-17T06:33:30Z",
  "published": "2026-08-15T06:32:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72450"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-16926 (CVE-2026-72450)

CVE-2026-72450 (GCVE-0-2026-72450)

GHSA-J58F-WQFC-2RV4

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour