CVE-2026-72444

CVE-2026-72444 patches an uninitialized memory read in the packet classification pipeline that propagated into a flow dissector hash table lookup key. The fix gates the Ethernet address memcpy on dev->type == ARPHRD_ETHER and returns zeroed addresses for non-Ethernet devices — the correct data-plane fix, but one that introduces a semantic side effect you need to understand. The vulnerability was a classic uninitialized struct field: when flow_dissect processed packets on non-Ethernet devices (IPoIB, FDDI, etc.), the ETH_ADDRS key field retained whatever kernel memory happened to precede it in the skb. The fix eliminates this by explicitly zeroing the field when the device type isn't Ethernet. What matters for your deployment: this zeroing creates deterministic matching behavior where none existed before. Any filter configured with an all-zero MAC address (00:00:00:00:00:00) as a source or destination selector will now reliably match non-Ethernet packets traversing the same TC block. Before this fix, such matching would have been unpredictable (effectively random memory). After the fix, it's guaranteed. The practical risk is this: if you operate mixed-link-layer environments where TC filter blocks are shared across Ethernet and non-Ethernet devices, an attacker who can inject IPoIB or other non-Ethernet traffic can now deterministically trigger filters designed for all-zero MAC matching. This was impossible to predict before and is now guaranteed behavior. Check your filter configurations now. Any all-zero MAC address selectors on shared TC blocks across heterogeneous link layers represent a classification contract you may not have intended. The mac_header sentinel check (~0U) fixed in the same commit is a separate hardening item — it prevents wild pointer computation from an unset mac_header, but whether that path was reachable in normal operation is unclear. The third iteration of heuristics now gates on dev->type == ARPHRD_ETHER; the previous two (ETH_P_IP checks, then hard_header_len >= 12) each introduced new semantic collisions. This pattern suggests other flow dissector keys may carry similar assumptions about L2 header presence that haven't been audited.

Reviewed through automated stages and approved by a human before publication.