CVE-2026-72248

CVE-2026-72248 is a netfilter flowtable vulnerability rooted in a fundamental mismatch between the subsystem's original design assumptions and how IPIP tunnel encapsulation actually behaves. The flowtable fast path uses a union to store either dst_cache (for routed traffic) or dst_cookie (for direct transmit), optimizing for the common case where direct xmit genuinely bypasses routing state. This worked until IPIP tunnels with direct xmit were added—a configuration that requires encapsulation headroom validation and fragment offset handling, yet was being processed as if routing state were irrelevant. The kernel crashed because the flowtable entry contained invalid dst data that the code path expected but never populated. The fix restructures dst_cache/dst_cookie into shared storage accessible to all transmit modes, removing the union and the xmit-type-dependent logic in nft_flow_dst_release(). This is architecturally cleaner but carries trade-offs worth understanding. What you should do: First, verify your kernel version is patched—check the netfilter flowtable code for the presence of the shared dst_storage structure and confirm nft_flow_dst_release() no longer contains xmit-mode conditional logic. If you're running an unpatched kernel with flowtables enabled and IPIP tunnels in use, the crash is triggerable through normal traffic. Second, audit any custom netfilter rules or flowtable extensions you have for assumptions about when dst_entry is populated—the fix changes those invariants. Third, monitor for regressions in neighbour and xfrm paths; the patch claims equivalence but the state lifecycle for direct xmit now follows different code. What should concern you: The removal of the xmit type check in nft_flow_dst_release() eliminates a defensive failure mode that previously caught similar violations. Future code that reintroduces xmit-type-dependent dst assumptions will fail silently rather than defensively. The 'cleaner' abstraction this fix creates makes it easier to extend the flowtable without understanding why dst availability once varied by transmit mode. Expect a lag before the next bug class surfaces—the kernel's history shows that simplifying state management interfaces tends to produce new vulnerability patterns 2-3 years later.

Reviewed through automated stages and approved by a human before publication.