CVE-2026-72450xfrm: validate selector family and prefixlen during match
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: - Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 before 87a5bbccc7ff4edb3f42fea387124237d2ba91ee; from 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 before bd7f202cf77556cff59f68dc30e4cdf40cb6e33b; from bce1afaa212ec380bf971614f70909a27882b862 before a3968ad4195d72c8fddcc6c0ef39da95ac98711a; from 7d9868180bd1e4cf37e7c5067362658971162366 before efa9e3b9f3dea2e1ea4c7edf4edc863faef85986; from 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 before 78783fefdc8f36879b1a17efa0d3195ea5f2dc5f; from 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 before 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe; from 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 before 5a03a2ee17e8259dde631ed84fd8322db06cb2ae; from 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 before 40f0b1047918539f0b0f795ac65e35336b4c2c78; and 10 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee
- https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b
- https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a
- https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986
- https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f
- https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe
- https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae
- https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.