External risk intelligence

Linux Kernel Netfilter Flowtable IP6IP6 Tunnel Handling Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72442

This vulnerability is located within the Linux kernel's netfilter flowtable implementation, specifically concerning low-level packet processing for IP6IP6 tunneling. It is not a user-facing service or application, but rather an internal kernel component that is not directly exposed as a public-facing network service or management interface in standard deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a security vulnerability within the Linux kernel's networking component that handles IP6IP6 tunnels. While resolved, the underlying complexity of packet handling in this specific area has been simplified and corrected to enhance security. The main concern is confirming whether this specific kernel functionality is relevant and exposed within your environment.

Network traffic handling flaw corrected.
Understand if this kernel area is used.
Confirm relevance to your environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially exploit this vulnerability by sending specially crafted network packets. These packets, processed by the netfilter subsystem's flowtable component, could trigger an issue in how IP6IP6 tunnels are handled. If successful, this could lead to a compromise of the system's integrity and availability.

Entry condition: Network access required.
Trigger point: Malformed IP6IP6 tunnel packets.
Resulting risk: System compromise and data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect how the Linux kernel processes specific types of IPv6-in-IPv6 encapsulated network traffic. When packets are handled by the netfilter flowtable, incorrect header processing could occur, potentially impacting the integrity and availability of network communications involving IP6IP6 tunnels, particularly those without complex extension headers.

Packet processing logic.
Incorrect header handling for tunnels.
Network communication disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's netfilter component, responsible for handling network packet filtering and manipulation, is affected by this vulnerability. Teams managing kernel updates, network infrastructure, or specific Linux-based security appliances are likely accountable. The initial step involves identifying all systems running the affected kernel version, confirming their network exposure and business criticality, and then coordinating with the system owners for remediation.

Kernel and Infrastructure teams own the fix.
Verify affected systems and their exposure.
Plan and execute kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel netfilter flowtable?

The netfilter flowtable is a core subsystem within the Linux kernel that accelerates network packet processing. By offloading the handling of established network flows directly to the hardware or lower levels of the kernel, it helps routers and firewalls manage traffic more efficiently. This specific vulnerability concerns how that component processes IP6IP6 tunnels, which are mechanisms for encapsulating IPv6 traffic within another layer of IPv6.

What does CVE-2026-72442 mean for system security?

This CVE describes a flaw in how the kernel handles packet headers for specific tunnel types. The issue relates to incorrect memory access logic during packet processing. Because the kernel relies on consistent header data to route traffic, malformed packets can confuse the system, potentially leading to unauthorized data access, system crashes, or compromised integrity of the network communication.

How can an attacker trigger this vulnerability?

An attacker triggers the issue by sending specially crafted, malformed IP6IP6 tunnel packets toward a vulnerable system. It is important to note that the vulnerability specifically impacts simple encapsulation handling. Consequently, traffic that utilizes complex IPv6 extension headers is not the primary trigger for this specific bug, as the flawed processing logic is bypassed or handled differently for those types of packets.

Do I need to worry if my system is internal?

According to Halo Surface Signal, this vulnerability is very unlikely to be accessible in typical environments. Because the flaw exists deep within kernel-level packet processing rather than a standard user-facing service, it is not directly reachable as a public network interface. However, if your internal infrastructure relies heavily on Linux-based routers or security appliances using this specific tunnel configuration, you should still evaluate your exposure.

When should I update my Linux kernel?

You should prioritize updates if your systems act as network gateways or security appliances that utilize IP6IP6 tunneling. Start by performing an inventory of your kernel versions to identify those that are vulnerable. Once identified, work with your infrastructure teams to schedule a kernel update, as this is a low-level component change that requires standard testing before deployment to production environments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.