---
id: CVE-2026-72254
title: 'netfilter: nft_fib: reject fib expression on the netdev egress hook'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_fib: reject fib expression on the netdev egress hook

  A fib expression in a netdev egress base chain dereferences nft_in(pkt),
  NULL on the transmit path,…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    4fee43759b489559a491f7c95f9bfa7a1d0c7a10
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    568931f26af4727a51e8521f72efbc78d3b82410
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    d01c913febead04a01a5f3a6374d1f45504dc523
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    f68305267ebda7e839b5e8f77e8d77535a3d5a0f
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    d07955dd34ecae17d35d8c7d0a273a3fba653a8c
  - Linux 5.16
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T18:45:20.670806Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:13.693Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72254'
references:
  - url: 'https://git.kernel.org/stable/c/4fee43759b489559a491f7c95f9bfa7a1d0c7a10'
  - url: 'https://git.kernel.org/stable/c/568931f26af4727a51e8521f72efbc78d3b82410'
  - url: 'https://git.kernel.org/stable/c/d01c913febead04a01a5f3a6374d1f45504dc523'
  - url: 'https://git.kernel.org/stable/c/f68305267ebda7e839b5e8f77e8d77535a3d5a0f'
  - url: 'https://git.kernel.org/stable/c/d07955dd34ecae17d35d8c7d0a273a3fba653a8c'
tags:
  - cve.org
epss: 0.00612
epssPercentile: 0.48239
ingestedAt: '2026-10-16T19:46:24.415Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_fib: reject fib expression on the netdev egress hook

A fib expression in a netdev egress base chain dereferences nft_in(pkt),
NULL on the transmit path, causing a NULL pointer dereference at eval.
nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook
numbers are a separate enum that aliases them (NF_NETDEV_EGRESS ==
NF_INET_LOCAL_IN), so an egress chain passes validation and then faults.

Add nft_fib_netdev_validate() that limits each result/flag to the netdev
hook where the device it reads exists: the input-device cases (OIF,
OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE
with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict
nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are
not applied to another family's hooks.

## Affected

- `Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 < 4fee43759b489559a491f7c95f9bfa7a1d0c7a10`
- `Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 < 568931f26af4727a51e8521f72efbc78d3b82410`
- `Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 < d01c913febead04a01a5f3a6374d1f45504dc523`
- `Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 < f68305267ebda7e839b5e8f77e8d77535a3d5a0f`
- `Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 < d07955dd34ecae17d35d8c7d0a273a3fba653a8c`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.