CVE-2026-72436
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase
Affected versions
Linux kernel versions
4.2
and later are affected. Fixed in
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc1
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-72436?
CVE-2026-72436 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.2 onward and has been patched in 6.1.178, 6.6.145, 6.12.97 and others. CVE-2026-72436 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72436?
Yes. CVE-2026-72436 has been patched. Fixed versions include 6.1.178, 6.6.145, 6.12.97 and others. If you are running Linux kernel 4.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72436 actively exploited?
No. CVE-2026-72436 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.