Bug 2516656 (CVE-2026-72450)

Summary: CVE-2026-72450 kernel: xfrm: validate selector family and prefixlen during match
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability, a shift-out-of-bounds error, occurs when an unspecified address family (AF_UNSPEC) selector with a large prefix length is incorrectly matched against an IPv4 flow. An attacker could potentially exploit this by sending specially crafted network packets, leading to memory corruption and causing the system to crash, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:24:16 UTC 
In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrm_selector_match()
due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched
against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).

Fix this by:

- Rejecting mismatched families in xfrm_selector_match.
- Returning false in addr4_match if prefixlen > 32.
- Returning false in addr_match if prefixlen > 128 (prevents overflow).
Comment 1 Keith Grant 2026-08-19 17:09:57 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-72450-f576@gregkh/T