# CVE-2026-72248: linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with d... CVE-2026-72248 is fixed in linux on 1 platform by DEBIAN-CVE-2026-72248 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2026-72248 - Priority: Urgent - CVSS: 9.8 (critical) - EPSS: 0.0055 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 15, 2026 ## Description In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst_entry is provided to check the skb headroom and to set the iph->frag_off field. This leads to invalid dst usage and can trigger a crash in the tunnel transmit path. Fix this by moving dst_cache and dst_cookie out of the runtime union so that they can be shared by neighbour, xfrm, and direct tunnel flows. For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve route state in these shared fields and release it through the common dst release path. Since dst_entry is now available to the three supported xmit modes and dst_release() already deals with NULL dst, remove the xmit type check in nft_flow_dst_release(). Moreover, skip the check if the dst entry is NULL in nf_flow_dst_check() which is now the case for the direct xmit case. Based on patch from Rein Wei . ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-72248](https://patchblox.com/security/data/fix/linux/debian-cve-2026-72248.md) | Aug 15, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.