In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrm_selector_match()
due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched
against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).

Fix this by:

- Rejecting mismatched families in xfrm_selector_match.
- Returning false in addr4_match if prefixlen > 32.
- Returning false in addr_match if prefixlen > 128 (prevents overflow).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 affected < 87a5bbccc7ff4edb3f42fea387124237d2ba91ee
2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 affected < bd7f202cf77556cff59f68dc30e4cdf40cb6e33b
bce1afaa212ec380bf971614f70909a27882b862 affected < a3968ad4195d72c8fddcc6c0ef39da95ac98711a
7d9868180bd1e4cf37e7c5067362658971162366 affected < efa9e3b9f3dea2e1ea4c7edf4edc863faef85986
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 affected < 78783fefdc8f36879b1a17efa0d3195ea5f2dc5f
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 affected < 6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 affected < 5a03a2ee17e8259dde631ed84fd8322db06cb2ae
3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 affected < 40f0b1047918539f0b0f795ac65e35336b4c2c78
f31398570acf0f0804c644006f7bfa9067106b0a affected —
401ad99a5ae7180dd9449eac104cb755f442e7f3 affected —
e68dd80ba498265d2266b12dc3459164f4ff0c4a affected —
5.10.229 affected < 5.10.261
5.15.170 affected < 5.15.212
6.1.115 affected < 6.1.178
6.6.59 affected < 6.6.145
4.19.323 affected < 4.20
5.4.285 affected < 5.5
6.11.6 affected < 6.12
Linux Linux affected
Version Status Constraints
6.12 affected —
0 unaffected < 6.12
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78 cve-icon cve-icon
https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae cve-icon cve-icon
https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe cve-icon cve-icon
https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f cve-icon cve-icon
https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee cve-icon cve-icon
https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a cve-icon cve-icon
https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b cve-icon cve-icon
https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: - Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow).
Title xfrm: validate selector family and prefixlen during match
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:56:58.939Z

Reserved: 2026-08-09T03:40:39.931Z

Link: CVE-2026-72450

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:18.950

Modified: 2026-08-15T06:22:18.950

Link: CVE-2026-72450

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.