CVE-2026-72254

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_fib: reject fib expression on the netdev egress hook

A fib expression in a netdev egress base chain dereferences nft_in(pkt),

NULL on the transmit path, causing a NULL pointer dereference at eval.

nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook

numbers are a separate enum that aliases them (NF_NETDEV_EGRESS ==

NF_INET_LOCAL_IN), so an egress chain passes validation and then faults.

Add nft_fib_netdev_validate() that limits each result/flag to the netdev

hook where the device it reads exists: the input-device cases (OIF,

OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE

with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict

nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are

not applied to another family's hooks.