Executive brief
The Linux kernel's netfilter subsystem, which handles network packet filtering and routing, contained a flaw in its ebtables compatibility layer (nft_compat). The vulnerability allowed incompatible Ethernet bridge packet filter targets to bypass validation checks, potentially allowing an attacker to inject misconfigured firewall rules that could disrupt network filtering, lead to traffic misdirection, or cause system instability.
Technical details
This is a validation bypass vulnerability in net/netfilter/nft_compat.c affecting the nf_tables compatibility layer for ebtables. The root cause is that ebtables targets return different verdict constants (EBT_ACCEPT, EBT_DROP, etc.) than xtables targets (NF_ACCEPT, NF_DROP), which are incompatible at the binary level. The code previously allowed the NFPROTO_UNSPEC protocol family to act as a fallback, enabling non-bridge targets to be used in bridge context through nft_compat, bypassing validation that was added to base ebtables in commit 11ff7288beb2. The fix introduces a bridge-specific validation function that explicitly rejects any target where family != NFPROTO_BRIDGE, preventing incompatible verdict interpretations. Attack requires local or network access to configure firewall rules via nf_tables interface, but no user interaction is needed once rule is loaded.
Affected products
- Linux Linux kernel affected versions prior to fix commit 9dbba7e694ec045f21ede2f892fb42b81b4e1692
Timeline
- 2026-08-15: disclosed: CVE-2026-72416 published
- 2026-06-15: patched: Upstream fix commit 9dbba7e694ec045f21ede2f892fb42b81b4e1692 by Florian Westphal
- 2026-07-24: patched: Stable kernel fix commit 33e1875d6b5b552a2e5652b40074c604199354ee