Bug 2516361 (CVE-2026-72416) - CVE-2026-72416 kernel: netfilter: nft_compat: ebtables emulation must reject non-bridge targets
Summary: CVE-2026-72416 kernel: netfilter: nft_compat: ebtables emulation must reject ...
Keywords:
Status: NEW
Alias: CVE-2026-72416
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-15 06:08 UTC by OSIDB Bzimport
Modified: 2026-08-19 16:11 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-15 06:08:28 UTC 
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so
on.  ebtables targets return incompatible verdicts: EBT_ACCEPT,
EBT_DROP, ...   We cannot allow fallback to NFPROTO_UNSPEC.

ebtables doesn't permit this since
11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets")
but that commit missed the nft_compat layer.
Comment 1 Keith Grant 2026-08-19 16:08:17 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081524-CVE-2026-72416-1a31@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.