CVE-2026-72250
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb->mac_header: skb->mac_header += sizeof(struct frag_hdr); On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7), after which skb_mac_header_was_set() wrongly reports a MAC header is present and skb_mac_header() points into the headroom. The reassembler has done this unconditional add since it was introduced; it was harmless while mac_header was a bare pointer, but wrong once mac_header became a u16 offset whose unset state is the ~0U sentinel tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c does the same relocation and does guard the adjustment; mirror the guard here.
Affected versions
Linux kernel versions
2.6.15
and later are affected. Fixed in
5.10.261,
5.15.212,
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc3
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-72250?
CVE-2026-72250 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.15 onward and has been patched in 5.10.261, 5.15.212, 6.1.178 and others. CVE-2026-72250 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72250?
Yes. CVE-2026-72250 has been patched. Fixed versions include 5.10.261, 5.15.212, 6.1.178 and others. If you are running Linux kernel 2.6.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72250 actively exploited?
No. CVE-2026-72250 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.