In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv…
CVE-2026-72250 · published 15 Aug 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-72250?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 2.6.15
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6
fragment header and then unconditionally advances skb->mac_header:
skb->mac_header += sizeof(struct frag_hdr);
On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header
yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding
sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7),
after which skb_mac_header_was_set() wrongly reports a MAC header is
present and skb_mac_header() points into the headroom.
The reassembler has done this unconditional add since it was introduced;
it was harmless while mac_header was a bare pointer, but wrong once
mac_header became a u16 offset whose unset state is the ~0U sentinel
tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c
does the same relocation and does guard the adjustment; mirror the
guard here.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/00bdce2fda7e430d24cfbc96764a1b96deb31f82
- git.kernel.org/stable/c/2a95ec21824a8ad81ad660b12231456fc0ac9830
- git.kernel.org/stable/c/3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9
- git.kernel.org/stable/c/53ef70a315420ed31581d38343684b3bf9a3c76d
- git.kernel.org/stable/c/6e8cd710ca35c576f5f2e5a396047c9ac61f75e5
- git.kernel.org/stable/c/a58230f3a7c4f6c3261786bc1efb72c42e68cd25
- git.kernel.org/stable/c/bbcdef2061b170af45702ce6b359c02c12acfc94
- git.kernel.org/stable/c/cd0d7bbc027b4d3329712cdcdeb4e5567ffd0d58
Merged from NVD. Last updated 23 Oct 2026. All vulnerabilities · RSS · JSON