CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match

CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_cluster: reject template conntracks in hash match

xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully
initialized conntrack and passes it to xt_cluster_hash().

This causes a state confusion bug when the raw table CT target attaches
a template conntrack to skb->_nfct before normal conntrack processing.
Templates carry IPS_TEMPLATE status but do not have a valid tuple for
hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the
zeroed l3num field.

Reject template conntracks before hashing them. This matches existing
netfilter handling for template objects and avoids hashing incomplete
conntrack state.

The Linux kernel CVE team has assigned CVE-2026-72256 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 5.10.261 with commit 4558bd7b47c7be82dffd837f27be8ea3ecee557d
	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 5.15.212 with commit d5f9d050b0b267227c1f02f11021872c7768a9cc
	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 6.1.178 with commit 4cb8b5f586e41c187942291cc0938006077fa79e
	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 6.6.145 with commit fac2fdac3baad9ffd12b3b0bba4374d4b3585d54
	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 6.12.97 with commit 13ea4f86cf738c74be2146886ac261988a631e62
	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 6.18.40 with commit 07f9ddbf5e799c24a3a52ec9bd7b729a6f6d69d5
	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 7.1.5 with commit 5b2d4f0010018a7aa3495aa1dbf1b7a34011e7aa
	Issue introduced in 2.6.30 with commit 0269ea4937343536ec7e85649932bc8c9686ea78 and fixed in 7.2-rc1 with commit 5feba91006ec92da57acc1cc2e34df623b98541e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72256
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/xt_cluster.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4558bd7b47c7be82dffd837f27be8ea3ecee557d
	https://git.kernel.org/stable/c/d5f9d050b0b267227c1f02f11021872c7768a9cc
	https://git.kernel.org/stable/c/4cb8b5f586e41c187942291cc0938006077fa79e
	https://git.kernel.org/stable/c/fac2fdac3baad9ffd12b3b0bba4374d4b3585d54
	https://git.kernel.org/stable/c/13ea4f86cf738c74be2146886ac261988a631e62
	https://git.kernel.org/stable/c/07f9ddbf5e799c24a3a52ec9bd7b729a6f6d69d5
	https://git.kernel.org/stable/c/5b2d4f0010018a7aa3495aa1dbf1b7a34011e7aa
	https://git.kernel.org/stable/c/5feba91006ec92da57acc1cc2e34df623b98541e