---
id: CVE-2026-72416
title: 'netfilter: nft_compat: ebtables emulation must reject non-bridge targets'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_compat: ebtables emulation must reject non-bridge targets

  xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so
  on.  ebtables targets re…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 <
    efc17b9240d821c424bc5191a5c6e9384a06293e
  - >-
    Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 <
    b3f7a84540a0d014ec42343ff5909657c1bd1994
  - >-
    Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 <
    33e1875d6b5b552a2e5652b40074c604199354ee
  - >-
    Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 <
    c129b0185e707dce405968e21afccd5728b2ce63
  - >-
    Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 <
    9dbba7e694ec045f21ede2f892fb42b81b4e1692
  - Linux 3.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T18:49:19.746704Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:22.509Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72416'
references:
  - url: 'https://git.kernel.org/stable/c/efc17b9240d821c424bc5191a5c6e9384a06293e'
  - url: 'https://git.kernel.org/stable/c/b3f7a84540a0d014ec42343ff5909657c1bd1994'
  - url: 'https://git.kernel.org/stable/c/33e1875d6b5b552a2e5652b40074c604199354ee'
  - url: 'https://git.kernel.org/stable/c/c129b0185e707dce405968e21afccd5728b2ce63'
  - url: 'https://git.kernel.org/stable/c/9dbba7e694ec045f21ede2f892fb42b81b4e1692'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06282
ingestedAt: '2026-10-16T19:46:24.398Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so
on.  ebtables targets return incompatible verdicts: EBT_ACCEPT,
EBT_DROP, ...   We cannot allow fallback to NFPROTO_UNSPEC.

ebtables doesn't permit this since
11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets")
but that commit missed the nft_compat layer.

## Affected

- `Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 < efc17b9240d821c424bc5191a5c6e9384a06293e`
- `Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 < b3f7a84540a0d014ec42343ff5909657c1bd1994`
- `Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 < 33e1875d6b5b552a2e5652b40074c604199354ee`
- `Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 < c129b0185e707dce405968e21afccd5728b2ce63`
- `Linux >= 0ca743a5599199152a31a7146b83213c786c2eb2 < 9dbba7e694ec045f21ede2f892fb42b81b4e1692`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.