Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-72450

xfrm: validate selector family and prefixlen during match

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 4.20, and 5 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: • Rejecting mismatched families in xfrm_selector_match. • Returning false in addr4_match if prefixlen > 32. • Returning false in addr_match if prefixlen > 128 (prevents overflow).

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 · fixed in 87a5bbccc7ff4edb3f42fea387124237d2ba91ee; From 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 · fixed in bd7f202cf77556cff59f68dc30e4cdf40cb6e33b; From bce1afaa212ec380bf971614f70909a27882b862 · fixed in a3968ad4195d72c8fddcc6c0ef39da95ac98711a; From 7d9868180bd1e4cf37e7c5067362658971162366 · fixed in efa9e3b9f3dea2e1ea4c7edf4edc863faef85986; From 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 · fixed in 78783fefdc8f36879b1a17efa0d3195ea5f2dc5f; From 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 · fixed in 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe; From 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 · fixed in 5a03a2ee17e8259dde631ed84fd8322db06cb2ae; From 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 · fixed in 40f0b1047918539f0b0f795ac65e35336b4c2c78; From 5.10.229 · fixed in 5.10.261; From 5.15.170 · fixed in 5.15.212; From 6.1.115 · fixed in 6.1.178; From 6.6.59 · fixed in 6.6.145; From 4.19.323 · fixed in 4.20; From 5.4.285 · fixed in 5.5; From 6.11.6 · fixed in 6.12

  • Linux Linux

    6.12

  • KernelLinux

    fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.97; From 6.12.0 · fixed in 6.18.40; From 6.13.0 · fixed in 7.1.5

References 8

git.kernel.org