External risk intelligence

Linux Kernel Netfilter Flowtable Incorrect Header Push

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72249

This vulnerability exists within the Linux kernel's netfilter flowtable implementation, which operates at the internal kernel network stack level. It is a low-level memory/packet handling issue not associated with an internet-facing application, service, or interface reachable by external users.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent vulnerability has been identified in the Linux kernel's netfilter component, which is responsible for network packet filtering and manipulation. This issue relates to how network traffic headers are managed, potentially impacting the processing of certain network connections. The main concern is to confirm if this specific kernel component is in use within our environment.

Uncovered issue in Linux network filtering.
Affects how network traffic headers are handled.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending specially crafted network traffic that targets the Linux kernel's netfilter component. This traffic manipulates how the kernel calculates the necessary space for an IPIP header, potentially leading to memory corruption and enabling the attacker to compromise the confidentiality, integrity, and availability of the system.

Network exposure required.
Crafted packets trigger vulnerability.
System compromise is the risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's netfilter flowtable could allow an attacker to influence packet handling and potentially impact network traffic integrity. When processing IPIP headers, the system incorrectly uses routing information from the wrong direction, affecting calculations for packet headroom and fragmentation offsets.

Kernel network packet handling.
Incorrect route information used.
Network traffic integrity compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's netfilter flowtable impacts network packet processing. Infrastructure or platform teams are likely responsible for the kernel itself, while network or security teams would be concerned with its exposure. The first practical step is to identify systems running the affected kernel, confirm their network reachability and business criticality, and then coordinate with the accountable team to plan remediation based on risk.

Infrastructure/platform teams own remediation.
Verify kernel reachability and criticality first.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel netfilter component?

Netfilter is a core subsystem within the Linux kernel that provides a framework for packet filtering, network address translation, and other packet manipulations. It acts as the gatekeeper for network traffic entering, leaving, or passing through a Linux-based system, making it essential for building firewalls and managing complex network routing configurations.

How does CVE-2026-72249 affect network traffic?

This vulnerability involves a logic error when the kernel prepares to push an IPIP (IP-in-IP) header onto a packet. The system mistakenly uses routing information from the wrong direction to calculate the required space, or headroom, for the header. This flaw can lead to improper memory handling when processing these specific network packets.

Do I need specific network conditions to trigger this bug?

Yes, an attacker must be able to send specially crafted network traffic that interacts with the netfilter flowtable. This vulnerability is specifically tied to the processing of IPIP encapsulated traffic. Simply sending standard, non-encapsulated network packets or traffic that does not traverse the affected flowtable logic will not trigger this specific memory calculation error.

Why is this vulnerability marked as external?

The CVSS classification identifies this as a network-based vulnerability, meaning it can theoretically be reached over a network. However, Halo Surface Signal analysis indicates that because this bug resides deep within the kernel's internal flowtable logic—rather than an internet-facing service or application—the likelihood of external exploitation is considered very unlikely.

When should I prioritize a response to this vulnerability?

You should start by identifying which systems in your environment are running the affected Linux kernel versions. Once you have an inventory, assess the business criticality of those systems and their network accessibility. Work with your platform or infrastructure teams to schedule updates, focusing your efforts on systems that handle untrusted or externally reachable IPIP traffic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.