Executive brief
The Linux kernel's IPv4 routing subsystem has a logic error in how it handles routing table lookups when multiple routing tables are configured. When certain conditions are met, the kernel incorrectly ignores error routes (such as "unreachable" routes) and uses a different route instead, causing traffic to be delivered when it should be rejected. This could allow unauthorized network access or bypass intended network policies.
Technical details
The vulnerability exists in the fib_lookup() function in include/net/ip_fib.h when CONFIG_IP_MULTIPLE_TABLES is enabled but no custom FIB rules are installed. The function performs sequential lookups on the local and main routing tables, then the default table. A logic error causes the first lookup to not properly bail out on error results, allowing subsequent lookups to overwrite error routes with regular routes. Specifically, the function initializes the error code to -ENETUNREACH but checks only if the first lookup succeeds (err == 0) before continuing, failing to check for error codes from routes marked as unreachable. The attack vector is network-based: any local or remote traffic matching the misconfigured routing tables can trigger the bug. The fix changes the initialization to -EAGAIN and modifies the condition to check if err != -EAGAIN, ensuring that error routes halt further lookups. A patch is available in upstream Linux kernel.
Affected products
- Linux Linux kernel Linux kernel 4.9 through 7.2 (all kernel versions from 2.6.11 onwards affected by the underlying condition, patch available)
Timeline
- 2026-08-15: disclosed: CVE-2026-72421 published
- 2026-07-24: patched: Patch included in stable kernel releases starting July 24, 2026