CVE-2026-72416
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the nft_compat layer fails to reject non-bridge targets in ebtables emulation. xtables targets return verdicts incompatible with ebtables, which may lead to incorrect behavior.
Risk Assessment
Potential for incorrect packet processing in bridge environments, possibly leading to bypass of filtering rules or unexpected network behavior.
Recommendation
Apply the Linux kernel update containing the fix for this CVE.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_compat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT, EBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC. ebtables doesn't permit this since 11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets") but that commit missed the nft_compat layer.