---
id: CVE-2026-72254
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_fib: reject fib expression on the netdev egress hook

  A fib expression in a netdev egress base chain dereferences nft_in(pkt),
  NULL on the transmit path,…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_fib: reject fib expression on the netdev egress hook

  A fib expression in a netdev egress base chain dereferences nft_in(pkt),
  NULL on the transmit path,…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    4fee43759b489559a491f7c95f9bfa7a1d0c7a10
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    568931f26af4727a51e8521f72efbc78d3b82410
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    d01c913febead04a01a5f3a6374d1f45504dc523
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    f68305267ebda7e839b5e8f77e8d77535a3d5a0f
  - >-
    Linux >= 42df6e1d221dddc0f2acf2be37e68d553ad65f96 <
    d07955dd34ecae17d35d8c7d0a273a3fba653a8c
  - Linux 5.16
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:17.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72254'
references:
  - url: 'https://git.kernel.org/stable/c/4fee43759b489559a491f7c95f9bfa7a1d0c7a10'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/568931f26af4727a51e8521f72efbc78d3b82410'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d01c913febead04a01a5f3a6374d1f45504dc523'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d07955dd34ecae17d35d8c7d0a273a3fba653a8c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f68305267ebda7e839b5e8f77e8d77535a3d5a0f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00612
epssPercentile: 0.49083
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T18:45:20.670806Z'
ingestedAt: '2026-10-16T19:46:24.415Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_fib: reject fib expression on the netdev egress hook

A fib expression in a netdev egress base chain dereferences nft_in(pkt),
NULL on the transmit path, causing a NULL pointer dereference at eval.
nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook
numbers are a separate enum that aliases them (NF_NETDEV_EGRESS ==
NF_INET_LOCAL_IN), so an egress chain passes validation and then faults.

Add nft_fib_netdev_validate() that limits each result/flag to the netdev
hook where the device it reads exists: the input-device cases (OIF,
OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE
with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict
nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are
not applied to another family's hooks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.