CVE-2026-72416

HighCVSS 7.3/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT, EBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.

ebtables doesn't permit this since 11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets") but that commit missed the nft_compat layer.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 0ca743a5599199152a31a7146b83213c786c2eb2, < efc17b9240d821c424bc5191a5c6e9384a06293e; >= 0ca743a5599199152a31a7146b83213c786c2eb2, < b3f7a84540a0d014ec42343ff5909657c1bd1994; >= 0ca743a5599199152a31a7146b83213c786c2eb2, < 33e1875d6b5b552a2e5652b40074c604199354ee; >= 0ca743a5599199152a31a7146b83213c786c2eb2, < c129b0185e707dce405968e21afccd5728b2ce63; >= 0ca743a5599199152a31a7146b83213c786c2eb2, < 9dbba7e694ec045f21ede2f892fb42b81b4e1692
LinuxLinux3.13

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-724179.8In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() CVE-2026-724187.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ctCVE-2026-724197.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_iCVE-2026-72429.8A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/csCVE-2026-724208.8In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5_Overlap races while breaking stripe batches KCSAN rCVE-2026-7242110.0In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG_CVE-2026-724229.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOCVE-2026-724238.8In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocaCVE-2026-72424In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313_rtc_CVE-2026-724257.1In the Linux kernel, the following vulnerability has been resolved: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() Resetting CVE-2026-724268.4In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup __clean_CVE-2026-724277.8In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPF_F_PREORDER replace_effect