{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72416", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.927Z", "datePublished": "2026-08-15T05:56:36.886Z", "dateUpdated": "2026-08-17T05:43:56.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:56.159Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_compat: ebtables emulation must reject non-bridge targets\n\nxtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so\non. ebtables targets return incompatible verdicts: EBT_ACCEPT,\nEBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.\n\nebtables doesn't permit this since\n11ff7288beb2 (\"netfilter: ebtables: reject non-bridge targets\")\nbut that commit missed the nft_compat layer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached by installing a bridge-family nft_compat rule through NETLINK_NETFILTER (nftables netlink), which is a local syscall path; packet evaluation on bridge hooks can be driven by traffic, but creating the vulnerable rule state requires local netfilter administration.\nAC:L - Exploitation is deterministic once CAP_NET_ADMIN is held in the target network namespace: xt_request_find_target() falls back to NFPROTO_UNSPEC targets, nft_target_eval_bridge() misinterprets xtables verdicts, and sending matching bridge traffic reliably triggers the faulty evaluation (e.g. NULL ct in nf_nat_setup_info()).\nPR:L - All nfnetlink entry points are gated by netlink_net_capable(..., CAP_NET_ADMIN), which checks the socket network namespace user namespace; unprivileged local users routinely obtain this capability via user+network namespaces (unshare -Urn), matching the reporters' nft_compat reproduction model.\nUI:N - No victim interaction is required beyond the attacker obtaining namespace-local CAP_NET_ADMIN and installing the malicious bridge nft_compat rule; subsequent packet delivery to the bridge hook is automatic once the rule is committed.\nS:U - Impact is confined to the host kernel and its network filtering state; this is not a VM escape, hypervisor boundary crossing, or IOMMU/DMA sandbox bypass, but standard in-kernel netfilter misbehavior within the same security authority.\nC:L - The primary primitive is verdict-namespace type confusion between xtables (NF_*) and ebtables (EBT_*) return conventions; while no arbitrary read is demonstrated, a triggered kernel oops from NULL ct dereference in nf_nat_setup_info() can expose kernel pointers in crash logs accessible to the local attacker.\nI:H - Incompatible verdict translation lets xtables targets run under ebtables semantics: XT_CONTINUE (0xFFFFFFFF/-1) is mapped to EBT_ACCEPT/NF_ACCEPT instead of continuing rule evaluation, and mis-instantiated targets such as SNAT/DNAT can alter connection-tracking/NAT state before faulting, constituting type-confusion integrity impact.\nA:H - Installing an IP-family UNSPEC target (e.g. SNAT/DNAT rev 1/2) in a bridge nft_compat chain and passing traffic causes nf_nat_setup_info() to dereference a NULL nf_conn from nf_ct_get(), producing a kernel oops/panic; repeated bridge traffic can retrigger the crash for sustained denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_compat.c"], "versions": [{"version": "0ca743a5599199152a31a7146b83213c786c2eb2", "lessThan": "efc17b9240d821c424bc5191a5c6e9384a06293e", "status": "affected", "versionType": "git"}, {"version": "0ca743a5599199152a31a7146b83213c786c2eb2", "lessThan": "b3f7a84540a0d014ec42343ff5909657c1bd1994", "status": "affected", "versionType": "git"}, {"version": "0ca743a5599199152a31a7146b83213c786c2eb2", "lessThan": "33e1875d6b5b552a2e5652b40074c604199354ee", "status": "affected", "versionType": "git"}, {"version": "0ca743a5599199152a31a7146b83213c786c2eb2", "lessThan": "c129b0185e707dce405968e21afccd5728b2ce63", "status": "affected", "versionType": "git"}, {"version": "0ca743a5599199152a31a7146b83213c786c2eb2", "lessThan": "9dbba7e694ec045f21ede2f892fb42b81b4e1692", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_compat.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/efc17b9240d821c424bc5191a5c6e9384a06293e"}, {"url": "https://git.kernel.org/stable/c/b3f7a84540a0d014ec42343ff5909657c1bd1994"}, {"url": "https://git.kernel.org/stable/c/33e1875d6b5b552a2e5652b40074c604199354ee"}, {"url": "https://git.kernel.org/stable/c/c129b0185e707dce405968e21afccd5728b2ce63"}, {"url": "https://git.kernel.org/stable/c/9dbba7e694ec045f21ede2f892fb42b81b4e1692"}], "title": "netfilter: nft_compat: ebtables emulation must reject non-bridge targets", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nft_compat.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "efc17b9240d821c424bc5191a5c6e9384a06293e", "status": "affected", "version": "0ca743a5599199152a31a7146b83213c786c2eb2", "versionType": "git"}, {"lessThan": "b3f7a84540a0d014ec42343ff5909657c1bd1994", "status": "affected", "version": "0ca743a5599199152a31a7146b83213c786c2eb2", "versionType": "git"}, {"lessThan": "33e1875d6b5b552a2e5652b40074c604199354ee", "status": "affected", "version": "0ca743a5599199152a31a7146b83213c786c2eb2", "versionType": "git"}, {"lessThan": "c129b0185e707dce405968e21afccd5728b2ce63", "status": "affected", "version": "0ca743a5599199152a31a7146b83213c786c2eb2", "versionType": "git"}, {"lessThan": "9dbba7e694ec045f21ede2f892fb42b81b4e1692", "status": "affected", "version": "0ca743a5599199152a31a7146b83213c786c2eb2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nft_compat.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_compat: ebtables emulation must reject non-bridge targets\n\nxtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so\non. ebtables targets return incompatible verdicts: EBT_ACCEPT,\nEBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.\n\nebtables doesn't permit this since\n11ff7288beb2 (\"netfilter: ebtables: reject non-bridge targets\")\nbut that commit missed the nft_compat layer."}], "id": "CVE-2026-72416", "lastModified": "2026-08-17T06:19:08.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:15.223", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/33e1875d6b5b552a2e5652b40074c604199354ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9dbba7e694ec045f21ede2f892fb42b81b4e1692"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3f7a84540a0d014ec42343ff5909657c1bd1994"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c129b0185e707dce405968e21afccd5728b2ce63"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/efc17b9240d821c424bc5191a5c6e9384a06293e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfilter: nft_compat: ebtables emulation must reject non-bridge targets", "id": "2516361", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516361"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-358", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nft_compat: ebtables emulation must reject non-bridge targets\nxtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so\non. ebtables targets return incompatible verdicts: EBT_ACCEPT,\nEBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.\nebtables doesn't permit this since\n11ff7288beb2 (\"netfilter: ebtables: reject non-bridge targets\")\nbut that commit missed the nft_compat layer.", "A flaw was found in the Linux kernel's `netfilter` component, specifically within the `nft_compat` layer. This vulnerability allows the `ebtables` emulation to process network traffic targets that it should normally reject. This oversight can lead to incorrect application of network filtering rules, potentially allowing unauthorized network access or bypassing intended security policies."], "name": "CVE-2026-72416", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72416\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72416\nhttps://lore.kernel.org/linux-cve-announce/2026081524-CVE-2026-72416-1a31@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca743a5599199152a31a7146b83213c786c2eb2,efc17b9240d821c424bc5191a5c6e9384a06293e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca743a5599199152a31a7146b83213c786c2eb2,b3f7a84540a0d014ec42343ff5909657c1bd1994)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca743a5599199152a31a7146b83213c786c2eb2,33e1875d6b5b552a2e5652b40074c604199354ee)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca743a5599199152a31a7146b83213c786c2eb2,c129b0185e707dce405968e21afccd5728b2ce63)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca743a5599199152a31a7146b83213c786c2eb2,9dbba7e694ec045f21ede2f892fb42b81b4e1692)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T11:15:03.435389+00:00", "updated": "2026-08-22T06:00:11.366367+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}