External risk intelligence

Linux Kernel Netfilter Flowtable Crash Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72248

This vulnerability exists within the Linux kernel's netfilter flowtable implementation, specifically regarding internal packet processing for IPIP tunnels. It is a low-level networking subsystem component not directly exposed to the public internet as a service or application endpoint.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent update to the Linux kernel's netfilter component, which manages network traffic flow, has been resolved. This issue involved a specific configuration with IPIP tunnels that could lead to system crashes due to improper handling of network routing information. While the vulnerability has been fixed, confirming its relevance to our environment is the primary concern.

Kernel networking issue fixed.
Confirms internal system stability.
Assess for potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic. This traffic would target the Linux kernel's netfilter component, specifically when it processes IPIP tunnels in a direct transmission mode. The vulnerability lies in how the kernel handles routing information for these tunnels, leading to a crash.

Entry condition: Unrestricted network access.
Trigger point: Processing IPIP tunnels with direct transmission.
Resulting risk: System crash.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the Linux kernel's netfilter component could encounter issues when processing IPIP tunnels with direct transmission. This could lead to invalid usage of routing information and potentially cause a crash within the tunnel's transmission path.

Kernel routing information.
Invalid routing during tunnel transmission.
System instability or crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Linux kernel's netfilter component, specifically its flowtable functionality. Responsibility for addressing this issue likely falls to infrastructure or platform teams managing Linux systems, in coordination with network and security teams to assess exposure and potential impact. The first practical step is to identify all Linux systems utilizing the netfilter flowtable with IPIP tunnel configurations, confirm their reachability and criticality, and then engage the appropriate system owners to plan remediation.

Infrastructure and platform teams own the resolution.
Verify netfilter flowtable and IPIP tunnel configurations.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel netfilter flowtable component?

The netfilter flowtable is a core networking subsystem in the Linux kernel designed to accelerate packet processing. It functions by offloading traffic flows to allow them to bypass standard, slower traversal paths. This mechanism is critical for performance in routers, firewalls, and complex networking setups that handle encapsulated traffic, such as IPIP tunnels.

Why does CVE-2026-72248 cause a system crash?

This vulnerability stems from a flaw in how the kernel manages destination routing information when using IPIP tunnels in direct transmission mode. Because the system fails to provide necessary routing data, the kernel attempts to access invalid memory or pointers during packet transit. This logic error effectively causes the kernel to panic, resulting in an immediate system crash.

How can an attacker trigger this kernel vulnerability?

An attacker triggers this by sending specifically crafted network traffic intended for an IPIP tunnel configured with direct transmission. Simply having networking capability does not guarantee the bug will trigger; the system must be actively processing traffic through a flowtable-enabled IPIP tunnel. Standard traffic that does not utilize this specific tunnel offloading configuration will not cause the crash.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal labels this risk as 'Very unlikely.' While the vulnerability is classified as having an external network attack vector, the defect resides deep within low-level kernel networking logic rather than a public-facing application or service endpoint. It is highly improbable for typical internet-facing services to be directly reachable through the specific, narrow networking path required to exploit this.

What should I do if I manage Linux systems?

Your first step is to inventory your infrastructure to identify which Linux machines specifically utilize netfilter flowtable offloading in combination with IPIP tunnel configurations. Once these systems are located, prioritize them based on their role and network reachability. Coordinate with your platform and infrastructure teams to apply the provided kernel updates to resolve the routing logic error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.