CVE-2026-72416 netfilter: nft_compat: ebtables emulation must reject non-bridge targets
The Linux kernel netfilter compatibility layer fails to reject incompatible ebtables targets, potentially causing undefined behavior or logic errors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72416?
CVE-2026-72416 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_compat: ebtables emulation must reject non-bridge targets
xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT, EBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.
ebtables doesn't permit this since 11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets") but that commit missed the nft_compat layer.
Which versions are affected by CVE-2026-72416?
How do I fix CVE-2026-72416?
Apply the vendor's patch.
Is CVE-2026-72416 being exploited?
There is no known exploitation of CVE-2026-72416 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72416, DEBIAN-CVE-2026-72416, GHSA-6mgv-g2fh-h577, UBUNTU-CVE-2026-72416.