CVE-2026-72450 - Vulnerability Details

- xfrm: validate selector family and prefixlen during match

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrm_selector_match()
due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched
against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).

Fix this by:

- Rejecting mismatched families in xfrm_selector_match.
- Returning false in addr4_match if prefixlen > 32.
- Returning false in addr_match if prefixlen > 128 (prevents overflow).

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8df5cd51fd70c33aa1776e5cbcd82b0a86649d73`	affected	< 87a5bbccc7ff4edb3f42fea387124237d2ba91ee
`2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71`	affected	< bd7f202cf77556cff59f68dc30e4cdf40cb6e33b
`bce1afaa212ec380bf971614f70909a27882b862`	affected	< a3968ad4195d72c8fddcc6c0ef39da95ac98711a
`7d9868180bd1e4cf37e7c5067362658971162366`	affected	< efa9e3b9f3dea2e1ea4c7edf4edc863faef85986
`3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563`	affected	< 78783fefdc8f36879b1a17efa0d3195ea5f2dc5f
`3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563`	affected	< 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe
`3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563`	affected	< 5a03a2ee17e8259dde631ed84fd8322db06cb2ae
`3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563`	affected	< 40f0b1047918539f0b0f795ac65e35336b4c2c78
`f31398570acf0f0804c644006f7bfa9067106b0a`	affected	—
`401ad99a5ae7180dd9449eac104cb755f442e7f3`	affected	—
`e68dd80ba498265d2266b12dc3459164f4ff0c4a`	affected	—
`5.10.229`	affected	< 5.10.261
`5.15.170`	affected	< 5.15.212
`6.1.115`	affected	< 6.1.178
`6.6.59`	affected	< 6.6.145
`4.19.323`	affected	< 4.20
`5.4.285`	affected	< 5.5
`6.11.6`	affected	< 6.12

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78
https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae
https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe
https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f
https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee
https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a
https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b
https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986

History

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: - Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).
Title		xfrm: validate selector family and prefixlen during match
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78 https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:56:58.939Z

Updated: 2026-08-15T05:56:58.939Z

Reserved: 2026-08-09T03:40:39.931Z

Link: CVE-2026-72450

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:18.950

Modified: 2026-08-15T06:22:18.950

Link: CVE-2026-72450

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object