CVE-2026-72421

The core vulnerability is a silent correctness failure in how the kernel's routing subsystem handles the "no rules configured" state. When CONFIG_IP_MULTIPLE_TABLES is enabled and no routing policy rules exist, the kernel falls back to a dual-table lookup that skips proper error handling. Specifically, the first lookup's error route gets blindly overwritten by the second lookup's result — error propagation logic that exists in the normal rules-based path simply wasn't copied to the fallback. The system doesn't crash; routing simply continues with the wrong policy applied, silently. This matters most for containerized deployments. Modern container runtimes and network namespaces ship with CONFIG_IP_MULTIPLE_TABLES enabled but typically don't configure explicit routing rules — they rely on the kernel's default behavior. In this default state, any error routes (such as blackhole routes meant to contain compromised workloads or null routes for network segmentation) are silently ignored. The system keeps functioning; the policy just stops enforcing. There's no observable failure, no error log, no indication that routing policy has been bypassed. A practical workaround exists: adding and immediately deleting a dummy rule forces the kernel onto its normal execution path, where error routes are respected. This works because the correct error-handling logic exists — it just wasn't applied to the unconfigured fallback. Check your network namespaces: if they have no routing policy rules (ip rule show returns only the default 'from all lookup main' and 'from all lookup default'), you're running in the vulnerable state. The workaround is low-risk to apply as a post-startup hook in container orchestration. The question worth investigating: whether IPv6 and other routing families share the same fallback pattern with identical error-handling gaps. If they do, this is a systematic oversight in how the routing core was factored, not an isolated mistake.

Reviewed through automated stages and approved by a human before publication.