CVE-2026-72450 (GCVE-0-2026-72450)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:44
VLAI
Title
xfrm: validate selector family and prefixlen during match
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: - Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 , < 87a5bbccc7ff4edb3f42fea387124237d2ba91ee (git)
Affected: 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 , < bd7f202cf77556cff59f68dc30e4cdf40cb6e33b (git)
Affected: bce1afaa212ec380bf971614f70909a27882b862 , < a3968ad4195d72c8fddcc6c0ef39da95ac98711a (git)
Affected: 7d9868180bd1e4cf37e7c5067362658971162366 , < efa9e3b9f3dea2e1ea4c7edf4edc863faef85986 (git)
Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 78783fefdc8f36879b1a17efa0d3195ea5f2dc5f (git)
Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe (git)
Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 5a03a2ee17e8259dde631ed84fd8322db06cb2ae (git)
Affected: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 , < 40f0b1047918539f0b0f795ac65e35336b4c2c78 (git)
Affected: f31398570acf0f0804c644006f7bfa9067106b0a (git)
Affected: 401ad99a5ae7180dd9449eac104cb755f442e7f3 (git)
Affected: e68dd80ba498265d2266b12dc3459164f4ff0c4a (git)
Affected: 5.10.229 , < 5.10.261 (semver)
Affected: 5.15.170 , < 5.15.212 (semver)
Affected: 6.1.115 , < 6.1.178 (semver)
Affected: 6.6.59 , < 6.6.145 (semver)
Affected: 4.19.323 , < 4.20 (semver)
Affected: 5.4.285 , < 5.5 (semver)
Affected: 6.11.6 , < 6.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87a5bbccc7ff4edb3f42fea387124237d2ba91ee",
              "status": "affected",
              "version": "8df5cd51fd70c33aa1776e5cbcd82b0a86649d73",
              "versionType": "git"
            },
            {
              "lessThan": "bd7f202cf77556cff59f68dc30e4cdf40cb6e33b",
              "status": "affected",
              "version": "2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71",
              "versionType": "git"
            },
            {
              "lessThan": "a3968ad4195d72c8fddcc6c0ef39da95ac98711a",
              "status": "affected",
              "version": "bce1afaa212ec380bf971614f70909a27882b862",
              "versionType": "git"
            },
            {
              "lessThan": "efa9e3b9f3dea2e1ea4c7edf4edc863faef85986",
              "status": "affected",
              "version": "7d9868180bd1e4cf37e7c5067362658971162366",
              "versionType": "git"
            },
            {
              "lessThan": "78783fefdc8f36879b1a17efa0d3195ea5f2dc5f",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "lessThan": "6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "lessThan": "5a03a2ee17e8259dde631ed84fd8322db06cb2ae",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "lessThan": "40f0b1047918539f0b0f795ac65e35336b4c2c78",
              "status": "affected",
              "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f31398570acf0f0804c644006f7bfa9067106b0a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "401ad99a5ae7180dd9449eac104cb755f442e7f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e68dd80ba498265d2266b12dc3459164f4ff0c4a",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.229",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.170",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.115",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.229",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.170",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.115",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.323",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.285",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: validate selector family and prefixlen during match\n\nsyzbot reported a shift-out-of-bounds in xfrm_selector_match()\ndue to AF_UNSPEC selector with large prefixlen (e.g. 128) matched\nagainst IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).\n\nFix this by:\n\n- Rejecting mismatched families in xfrm_selector_match.\n- Returning false in addr4_match if prefixlen \u003e 32.\n- Returning false in addr_match if prefixlen \u003e 128 (prevents overflow)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is armed via NETLINK_XFRM (XFRM_MSG_NEWSA with XFRM_STATE_AF_UNSPEC) in xfrm_user_rcv_msg(), and per kernel CNA guidance xfrm/netlink configuration is Local even though xfrm_selector_match() is later hit from IPv4/IPv6 packet processing in __xfrm_policy_check() and xfrm_state_look_at().\nAC:L - The attacker fully controls the malformed SA selector (AF_UNSPEC with prefixlen up to 255) and can deterministically trigger matching by sending or receiving IPv4/IPv6 traffic through xfrm; no race, victim state, or memory layout outside attacker control is required.\nPR:L - xfrm_user_rcv_msg() requires netlink_net_capable(CAP_NET_ADMIN), evaluated against the socket net namespace user_ns via ns_capable(); an unprivileged local user obtains CAP_NET_ADMIN with unshare -Urn and can install the poisoned SA and matching policy in that namespace.\nUI:N - The attacker performs the entire sequence\u2014installing the XFRM SA/policy over netlink and generating matching traffic\u2014with no action required from any other user, administrator, or victim.\nS:U - The shift-out-of-bounds and out-of-bounds memcmp reads occur entirely within kernel xfrm selector matching on the same host; no VM escape, IOMMU bypass, or cross-security-authority boundary is crossed.\nC:H - addr4_match() performs an undefined left-shift when prefixlen\u003e32 on IPv4 flows, and addr_match() can memcmp() up to (prefixlen\u003e\u003e5)\u003c\u003c2 bytes past 16-byte selector/flow addresses when prefixlen\u003e128 on IPv6, leaking adjacent kernel memory per CNA OOB-read guidance.\nI:H - C11 undefined-behavior shifts in hot-path packet classification and unchecked prefix comparisons can corrupt mask/offset arithmetic and selector-match control flow, giving attacker-influenced kernel behavior exploitable for integrity compromise per CNA memory-unsafe-operation guidance.\nA:H - syzbot reproduced UBSAN shift-out-of-bounds in xfrm_selector_match(), and undefined shifts plus out-of-bounds reads in the xfrm input/policy-check path can provoke kernel oops/panic (especially with panic_on_warn/KASAN), satisfying CNA guidance that kernel crashes are High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:19.730Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a"
        },
        {
          "url": "https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986"
        },
        {
          "url": "https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78"
        }
      ],
      "title": "xfrm: validate selector family and prefixlen during match",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72450",
    "datePublished": "2026-08-15T05:56:58.939Z",
    "dateReserved": "2026-08-09T03:40:39.931Z",
    "dateUpdated": "2026-08-17T05:44:19.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72450",
      "date": "2026-09-21",
      "epss": "0.00169",
      "percentile": "0.06594"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xfrm.h",
                  "net/xfrm/xfrm_policy.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "87a5bbccc7ff4edb3f42fea387124237d2ba91ee",
                    "status": "affected",
                    "version": "8df5cd51fd70c33aa1776e5cbcd82b0a86649d73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd7f202cf77556cff59f68dc30e4cdf40cb6e33b",
                    "status": "affected",
                    "version": "2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3968ad4195d72c8fddcc6c0ef39da95ac98711a",
                    "status": "affected",
                    "version": "bce1afaa212ec380bf971614f70909a27882b862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "efa9e3b9f3dea2e1ea4c7edf4edc863faef85986",
                    "status": "affected",
                    "version": "7d9868180bd1e4cf37e7c5067362658971162366",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "78783fefdc8f36879b1a17efa0d3195ea5f2dc5f",
                    "status": "affected",
                    "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe",
                    "status": "affected",
                    "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a03a2ee17e8259dde631ed84fd8322db06cb2ae",
                    "status": "affected",
                    "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "40f0b1047918539f0b0f795ac65e35336b4c2c78",
                    "status": "affected",
                    "version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f31398570acf0f0804c644006f7bfa9067106b0a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "401ad99a5ae7180dd9449eac104cb755f442e7f3",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e68dd80ba498265d2266b12dc3459164f4ff0c4a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.261",
                    "status": "affected",
                    "version": "5.10.229",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.212",
                    "status": "affected",
                    "version": "5.15.170",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.178",
                    "status": "affected",
                    "version": "6.1.115",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.145",
                    "status": "affected",
                    "version": "6.6.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.323",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.285",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "affected",
                    "version": "6.11.6",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xfrm.h",
                  "net/xfrm/xfrm_policy.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: validate selector family and prefixlen during match\n\nsyzbot reported a shift-out-of-bounds in xfrm_selector_match()\ndue to AF_UNSPEC selector with large prefixlen (e.g. 128) matched\nagainst IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).\n\nFix this by:\n\n- Rejecting mismatched families in xfrm_selector_match.\n- Returning false in addr4_match if prefixlen \u003e 32.\n- Returning false in addr_match if prefixlen \u003e 128 (prevents overflow)."
          }
        ],
        "id": "CVE-2026-72450",
        "lastModified": "2026-08-17T06:19:12.517",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:18.950",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:46:13+00:00",
      "cve": "CVE-2026-72450",
      "id": "CVE-2026-72450",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: validate selector family and prefixlen during match",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72450.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:25:36Z",
      "cve": "CVE-2026-72450",
      "id": "CVE-2026-72450",
      "initial_release_date": "2026-09-03T00:07:20Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "233",
      "product_status:known_not_affected": "129",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72450",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72450.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.