{"id":6879,"date":"2026-09-04T18:49:20","date_gmt":"2026-09-04T10:49:20","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72254"},"modified":"2026-09-04T18:49:20","modified_gmt":"2026-09-04T10:49:20","slug":"cve-2026-72254","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72254","title":{"rendered":"CVE-2026-72254 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_fib: r"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nft_fib: reject fib expression on the netdev egress hook<\/p>\n<p>A fib expression in a netdev egress base chain dereferences nft_in(pkt),<br \/>\nNULL on the transmit path, causing a NULL pointer dereference at eval.<br \/>\nnft_fib_validate() masks the hook with NF_INET_* values, but netdev hook<br \/>\nnumbers are a separate enum that aliases them (NF_NETDEV_EGRESS ==<br \/>\nNF_INET_LOCAL_IN), so an egress chain passes validation and then faults.<\/p>\n<p>Add nft_fib_netdev_validate() that limits each result\/flag to the netdev<br \/>\nhook where the device it reads exists: the input-device cases (OIF,<br \/>\nOIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE<br \/>\nwith F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict<br \/>\nnft_fib_validate() to NFPROTO_IPV4\/IPV6\/INET so its NF_INET_* masks are<br \/>\nnot applied to another family&#8217;s hooks.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nft_fib: reject fib expression on the netdev egress hook<\/p>\n<p>A fib expression in a netdev egress base chain dereferences nf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6879","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6879","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6879"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6879"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6879"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}