CVE-2026-72246: netfilter: flowtable: use correct direction to set up tunnel route

CVE-2026-72246: netfilter: flowtable: use correct direction to set up tunnel route

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: use correct direction to set up tunnel route

The layer 2 encapsulation and layer 3 tunnel information in the xmit
path is taken from the other tuple, because the tunnel information that
is included in the tuple for hashtable lookups is also used to perform
the egress encapsulation in the transmit path.

This patch uses the correct direction when setting up the tunnel, the
original proposed patch to address this fix uses the reversed direction.

While at it, remove the redundant check to call dst_release() to drop
the reference on the dst that was obtained from the forward path, which
is not useful in the direct xmit path unless tunneling is performed.

The Linux kernel CVE team has assigned CVE-2026-72246 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 7.2-rc3 with commit fa7395c02d95e51bad2952325d2d6503bfbad437 and fixed in 7.2-rc4 with commit 90941d9c925d66a482c9121919ec3546a6988c16

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72246
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_flow_table_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/392d033fd372268015bc5a54ba7c593ba44940d1
	https://git.kernel.org/stable/c/90941d9c925d66a482c9121919ec3546a6988c16