---
id: CVE-2026-72256
title: 'netfilter: xt_cluster: reject template conntracks in hash match'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: xt_cluster: reject template conntracks in hash match

  xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully
  initialized conntrack and passes it t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    4558bd7b47c7be82dffd837f27be8ea3ecee557d
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    d5f9d050b0b267227c1f02f11021872c7768a9cc
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    4cb8b5f586e41c187942291cc0938006077fa79e
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    fac2fdac3baad9ffd12b3b0bba4374d4b3585d54
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    13ea4f86cf738c74be2146886ac261988a631e62
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    07f9ddbf5e799c24a3a52ec9bd7b729a6f6d69d5
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    5b2d4f0010018a7aa3495aa1dbf1b7a34011e7aa
  - >-
    Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 <
    5feba91006ec92da57acc1cc2e34df623b98541e
  - Linux 2.6.30
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:53:38.810465Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:24.042Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72256'
references:
  - url: 'https://git.kernel.org/stable/c/4558bd7b47c7be82dffd837f27be8ea3ecee557d'
  - url: 'https://git.kernel.org/stable/c/d5f9d050b0b267227c1f02f11021872c7768a9cc'
  - url: 'https://git.kernel.org/stable/c/4cb8b5f586e41c187942291cc0938006077fa79e'
  - url: 'https://git.kernel.org/stable/c/fac2fdac3baad9ffd12b3b0bba4374d4b3585d54'
  - url: 'https://git.kernel.org/stable/c/13ea4f86cf738c74be2146886ac261988a631e62'
  - url: 'https://git.kernel.org/stable/c/07f9ddbf5e799c24a3a52ec9bd7b729a6f6d69d5'
  - url: 'https://git.kernel.org/stable/c/5b2d4f0010018a7aa3495aa1dbf1b7a34011e7aa'
  - url: 'https://git.kernel.org/stable/c/5feba91006ec92da57acc1cc2e34df623b98541e'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.1215
ingestedAt: '2026-11-06T18:00:12.583Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_cluster: reject template conntracks in hash match

xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully
initialized conntrack and passes it to xt_cluster_hash().

This causes a state confusion bug when the raw table CT target attaches
a template conntrack to skb->_nfct before normal conntrack processing.
Templates carry IPS_TEMPLATE status but do not have a valid tuple for
hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the
zeroed l3num field.

Reject template conntracks before hashing them. This matches existing
netfilter handling for template objects and avoids hashing incomplete
conntrack state.

## Affected

- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < 4558bd7b47c7be82dffd837f27be8ea3ecee557d`
- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < d5f9d050b0b267227c1f02f11021872c7768a9cc`
- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < 4cb8b5f586e41c187942291cc0938006077fa79e`
- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < fac2fdac3baad9ffd12b3b0bba4374d4b3585d54`
- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < 13ea4f86cf738c74be2146886ac261988a631e62`
- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < 07f9ddbf5e799c24a3a52ec9bd7b729a6f6d69d5`
- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < 5b2d4f0010018a7aa3495aa1dbf1b7a34011e7aa`
- `Linux >= 0269ea4937343536ec7e85649932bc8c9686ea78 < 5feba91006ec92da57acc1cc2e34df623b98541e`
- `Linux 2.6.30`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.