GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72421 (GCVE-0-2026-72421)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:44
VLAI
Title
ipv4: fib: Don't ignore error route in local/main tables.
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table: # unshare -n # ip link set lo up # ip route add 192.168.0.0/24 dev lo table 253 # ip route add unreachable 192.168.0.0/24 # ip route get 192.168.0.1 192.168.0.1 dev lo table default uid 0 cache <local> Once a random rule is added, the error route is respected: # ip rule add table 0 # ip rule del table 0 # ip route get 192.168.0.1 RTNETLINK answers: No route to host Let's fix the inconsistent behaviour.
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < a29e95fbc51e8a1b932773fd0e259b2080881443 (git)
Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < 5ae18d87a45698e8244d0fcba64c658c35a7dd3d (git)
Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < 9127589aabdee588278e8d0d0bd3709a760a92c8 (git)
Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < 49eaf1403201357762d745a35882fb734107d763 (git)
Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < fd25996f57a95d56bc568c89b4921edcf334b7d8 (git)
Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < 828fad4fd418bcdb9f5d66fec0d184c52a85ec31 (git)
Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < a668fa160247d7bbe921548cb845f607b8b9305f (git)
Affected: f4530fa574df4d833506c53697ed1daa0d390bf4 , < b72f0db64205d9ce462038ba995d5d31eff32dc1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.6
Unaffected: 0 , < 3.6 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_fib.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a29e95fbc51e8a1b932773fd0e259b2080881443",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            },
            {
              "lessThan": "5ae18d87a45698e8244d0fcba64c658c35a7dd3d",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            },
            {
              "lessThan": "9127589aabdee588278e8d0d0bd3709a760a92c8",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            },
            {
              "lessThan": "49eaf1403201357762d745a35882fb734107d763",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            },
            {
              "lessThan": "fd25996f57a95d56bc568c89b4921edcf334b7d8",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            },
            {
              "lessThan": "828fad4fd418bcdb9f5d66fec0d184c52a85ec31",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            },
            {
              "lessThan": "a668fa160247d7bbe921548cb845f607b8b9305f",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            },
            {
              "lessThan": "b72f0db64205d9ce462038ba995d5d31eff32dc1",
              "status": "affected",
              "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_fib.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: Don\u0027t ignore error route in local/main tables.\n\nWhen CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,\nfib_lookup() performs route lookup directly on two tables.\n\nSince the first lookup does not properly bail out, the result\nof an error route in the merged local/main table could be\noverwritten by another route in the default table:\n\n  # unshare -n\n  # ip link set lo up\n  # ip route add 192.168.0.0/24 dev lo table 253\n  # ip route add unreachable 192.168.0.0/24\n  # ip route get 192.168.0.1\n  192.168.0.1 dev lo table default uid 0\n      cache \u003clocal\u003e\n\nOnce a random rule is added, the error route is respected:\n\n  # ip rule add table 0\n  # ip rule del table 0\n  # ip route get 192.168.0.1\n  RTNETLINK answers: No route to host\n\nLet\u0027s fix the inconsistent behaviour."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fib_lookup() is on the IPv4 receive and transmit datapaths (ip_route_input_rcu, ip_route_output_key, forwarding) reached by remote packets on internet-facing routers, gateways, cloud hosts, and container nodes without any local syscall.\nAC:L - Once main/local holds an error route and default has an overlapping prefix (reproduced in the fix commit with basic ip-route commands), any matching packet or socket lookup deterministically hits the bypass; no race or attacker-independent memory layout is required.\nPR:N - Overlapping table layout is a deployment/CAP_NET_ADMIN prerequisite, but exploitation only requires sending traffic or using sockets; the remote attacker needs no credentials or privileges on the victim once the vulnerable routing state exists.\nUI:N - Route resolution runs automatically in the kernel networking stack during normal packet forwarding and connection setup; no victim mount, click, or file open is needed beyond ordinary network use.\nS:C - Bypassing unreachable/prohibit/blackhole routes can defeat network-namespace/pod egress blackholes and segmentation boundaries on multi-tenant hosts and routers, allowing access outside the intended isolated security scope.\nC:H - Ignored error routes let traffic reach destinations deliberately isolated (internal networks, metadata endpoints, sinkholed ranges), exposing data that routing policy was designed to keep inaccessible.\nI:H - Packets that should be dropped or rejected are instead forwarded via the default-table route, enabling injection of traffic into networks marked unreachable, prohibited, or blackhole.\nA:N - The defect is incorrect route selection only; it does not corrupt memory, panic the kernel, deadlock, or inherently exhaust resources, so availability impact is none."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:01.658Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a29e95fbc51e8a1b932773fd0e259b2080881443"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ae18d87a45698e8244d0fcba64c658c35a7dd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9127589aabdee588278e8d0d0bd3709a760a92c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/49eaf1403201357762d745a35882fb734107d763"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd25996f57a95d56bc568c89b4921edcf334b7d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/828fad4fd418bcdb9f5d66fec0d184c52a85ec31"
        },
        {
          "url": "https://git.kernel.org/stable/c/a668fa160247d7bbe921548cb845f607b8b9305f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b72f0db64205d9ce462038ba995d5d31eff32dc1"
        }
      ],
      "title": "ipv4: fib: Don\u0027t ignore error route in local/main tables.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72421",
    "datePublished": "2026-08-15T05:56:40.466Z",
    "dateReserved": "2026-08-09T03:40:39.927Z",
    "dateUpdated": "2026-08-17T05:44:01.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72421",
      "date": "2026-09-19",
      "epss": "0.00571",
      "percentile": "0.4595"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/ip_fib.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a29e95fbc51e8a1b932773fd0e259b2080881443",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5ae18d87a45698e8244d0fcba64c658c35a7dd3d",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9127589aabdee588278e8d0d0bd3709a760a92c8",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "49eaf1403201357762d745a35882fb734107d763",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd25996f57a95d56bc568c89b4921edcf334b7d8",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "828fad4fd418bcdb9f5d66fec0d184c52a85ec31",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a668fa160247d7bbe921548cb845f607b8b9305f",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b72f0db64205d9ce462038ba995d5d31eff32dc1",
                    "status": "affected",
                    "version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/ip_fib.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.6"
                  },
                  {
                    "lessThan": "3.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: Don\u0027t ignore error route in local/main tables.\n\nWhen CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,\nfib_lookup() performs route lookup directly on two tables.\n\nSince the first lookup does not properly bail out, the result\nof an error route in the merged local/main table could be\noverwritten by another route in the default table:\n\n  # unshare -n\n  # ip link set lo up\n  # ip route add 192.168.0.0/24 dev lo table 253\n  # ip route add unreachable 192.168.0.0/24\n  # ip route get 192.168.0.1\n  192.168.0.1 dev lo table default uid 0\n      cache \u003clocal\u003e\n\nOnce a random rule is added, the error route is respected:\n\n  # ip rule add table 0\n  # ip rule del table 0\n  # ip route get 192.168.0.1\n  RTNETLINK answers: No route to host\n\nLet\u0027s fix the inconsistent behaviour."
          }
        ],
        "id": "CVE-2026-72421",
        "lastModified": "2026-08-17T06:19:09.257",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.8,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:15.867",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/49eaf1403201357762d745a35882fb734107d763"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5ae18d87a45698e8244d0fcba64c658c35a7dd3d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/828fad4fd418bcdb9f5d66fec0d184c52a85ec31"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9127589aabdee588278e8d0d0bd3709a760a92c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a29e95fbc51e8a1b932773fd0e259b2080881443"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a668fa160247d7bbe921548cb845f607b8b9305f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b72f0db64205d9ce462038ba995d5d31eff32dc1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd25996f57a95d56bc568c89b4921edcf334b7d8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T17:54:15+00:00",
      "cve": "CVE-2026-72421",
      "id": "CVE-2026-72421",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv4: fib: Don\u0027t ignore error route in local/main tables",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72421.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:25:57Z",
      "cve": "CVE-2026-72421",
      "id": "CVE-2026-72421",
      "initial_release_date": "2026-08-27T16:52:47Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "358",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72421",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72421.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.