---
id: CVE-2026-72450
title: 'xfrm: validate selector family and prefixlen during match'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: validate selector family and prefixlen during match

  syzbot reported a shift-out-of-bounds in xfrm_selector_match()
  due to AF_UNSPEC selector with large prefixlen…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 <
    87a5bbccc7ff4edb3f42fea387124237d2ba91ee
  - >-
    Linux >= 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 <
    bd7f202cf77556cff59f68dc30e4cdf40cb6e33b
  - >-
    Linux >= bce1afaa212ec380bf971614f70909a27882b862 <
    a3968ad4195d72c8fddcc6c0ef39da95ac98711a
  - >-
    Linux >= 7d9868180bd1e4cf37e7c5067362658971162366 <
    efa9e3b9f3dea2e1ea4c7edf4edc863faef85986
  - >-
    Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 <
    78783fefdc8f36879b1a17efa0d3195ea5f2dc5f
  - >-
    Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 <
    6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe
  - >-
    Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 <
    5a03a2ee17e8259dde631ed84fd8322db06cb2ae
  - >-
    Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 <
    40f0b1047918539f0b0f795ac65e35336b4c2c78
  - Linux f31398570acf0f0804c644006f7bfa9067106b0a
  - Linux 401ad99a5ae7180dd9449eac104cb755f442e7f3
  - Linux e68dd80ba498265d2266b12dc3459164f4ff0c4a
  - Linux >= 5.10.229 < 5.10.261
  - Linux >= 5.15.170 < 5.15.212
  - Linux >= 6.1.115 < 6.1.178
  - Linux >= 6.6.59 < 6.6.145
  - Linux >= 4.19.323 < 4.20
  - Linux >= 5.4.285 < 5.5
  - Linux >= 6.11.6 < 6.12
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:50:15.343640Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:24.828Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72450'
references:
  - url: 'https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee'
  - url: 'https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b'
  - url: 'https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a'
  - url: 'https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986'
  - url: 'https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f'
  - url: 'https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe'
  - url: 'https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae'
  - url: 'https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06644
ingestedAt: '2026-10-16T19:46:24.394Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrm_selector_match()
due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched
against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).

Fix this by:

- Rejecting mismatched families in xfrm_selector_match.
- Returning false in addr4_match if prefixlen > 32.
- Returning false in addr_match if prefixlen > 128 (prevents overflow).

## Affected

- `Linux >= 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 < 87a5bbccc7ff4edb3f42fea387124237d2ba91ee`
- `Linux >= 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 < bd7f202cf77556cff59f68dc30e4cdf40cb6e33b`
- `Linux >= bce1afaa212ec380bf971614f70909a27882b862 < a3968ad4195d72c8fddcc6c0ef39da95ac98711a`
- `Linux >= 7d9868180bd1e4cf37e7c5067362658971162366 < efa9e3b9f3dea2e1ea4c7edf4edc863faef85986`
- `Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 < 78783fefdc8f36879b1a17efa0d3195ea5f2dc5f`
- `Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 < 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe`
- `Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 < 5a03a2ee17e8259dde631ed84fd8322db06cb2ae`
- `Linux >= 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 < 40f0b1047918539f0b0f795ac65e35336b4c2c78`
- `Linux f31398570acf0f0804c644006f7bfa9067106b0a`
- `Linux 401ad99a5ae7180dd9449eac104cb755f442e7f3`
- `Linux e68dd80ba498265d2266b12dc3459164f4ff0c4a`
- `Linux >= 5.10.229 < 5.10.261`
- `Linux >= 5.15.170 < 5.15.212`
- `Linux >= 6.1.115 < 6.1.178`
- `Linux >= 6.6.59 < 6.6.145`
- `Linux >= 4.19.323 < 4.20`
- `Linux >= 5.4.285 < 5.5`
- `Linux >= 6.11.6 < 6.12`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.