CVE-2026-72416

Summary

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT, EBT_DROP, … We cannot allow fallback to NFPROTO_UNSPEC.

ebtables doesn't permit this since 11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets") but that commit missed the nft_compat layer.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux0ca743a5599199152a31a7146b83213c786c2eb2 < efc17b9240d821c424bc5191a5c6e9384a06293eaffected
LinuxLinux0ca743a5599199152a31a7146b83213c786c2eb2 < b3f7a84540a0d014ec42343ff5909657c1bd1994affected
LinuxLinux0ca743a5599199152a31a7146b83213c786c2eb2 < 33e1875d6b5b552a2e5652b40074c604199354eeaffected
LinuxLinux0ca743a5599199152a31a7146b83213c786c2eb2 < c129b0185e707dce405968e21afccd5728b2ce63affected
LinuxLinux0ca743a5599199152a31a7146b83213c786c2eb2 < 9dbba7e694ec045f21ede2f892fb42b81b4e1692affected
LinuxLinux3.13affected
LinuxLinux0 < 3.13unaffected
LinuxLinux6.6.145 <= 6.6.*unaffected
LinuxLinux6.12.97 <= 6.12.*unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.5 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References