CVE-2026-72444: In the Linux kernel, the following vulnerability has been resolved: flow_dissector: check device type before reading ET
Summary
A Linux kernel vulnerability allowed the flow_dissector (the part that examines packet headers to classify network traffic) to read 12 bytes of uninitialized memory from packets on non-Ethernet devices like TUN adapters in L3 mode, which don't have Ethernet headers where the code expected them. This corrupted memory could then be used as a lookup key in the kernel, potentially causing unpredictable behavior.
Solution / Mitigation
The fix gates the memory read operation on two checks: (1) verify that dev->type == ARPHRD_ETHER (the device is actually Ethernet), and (2) check skb_mac_header_was_set() to ensure the mac_header pointer is valid. This ensures the code only reads Ethernet address data from actual Ethernet-framed packets, and on non-Ethernet devices, the key is zeroed instead of reading garbage memory.
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72444
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%