CVE-2026-72450 xfrm: validate selector family and prefixlen during match
A shift-out-of-bounds vulnerability in the Linux kernel's xfrm subsystem can cause a denial of service when specific non-default state flags are set.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72450?
CVE-2026-72450 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: validate selector family and prefixlen during match
syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).
Fix this by:
- Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).
Which versions are affected by CVE-2026-72450?
How do I fix CVE-2026-72450?
Apply the vendor's patch.
Is CVE-2026-72450 being exploited?
There is no known exploitation of CVE-2026-72450 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72450, DEBIAN-CVE-2026-72450, GHSA-j58f-wqfc-2rv4, UBUNTU-CVE-2026-72450.