CVE-2026-72444: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-2vpj-2c73-pm86
Share
CVSS 7.8
Published
Advisory Summary

CVE-2026-72444 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72444 at a Glance

CVE Identifier CVE-2026-72444
GHSA Identifier GHSA-2vpj-2c73-pm86
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-72444

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72444, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: check device type before reading ETH_ADDRS __skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb) when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb has a valid Ethernet header at mac_header, which is not always the case. The problem can be triggered by: 1. Creating a TUN device in L3 mode (IFF_TUN, hard_header_len=0) 2. Attaching a multiq qdisc with a flower filter matching on eth_src 3. Sending a packet through AF_PACKET Since TUN in L3 mode has no link-layer header, mac_header points to the L3 data area. The flow dissector reads 12 bytes of uninitialized skb memory, which then propagates through fl_set_masked_key() and is used as a rhashtable lookup key in __fl_lookup(), as reported by KMSAN. Rejecting the filter in the control path (at tc filter add time) is not feasible because TC filter blocks can be shared between arbitrary devices -- a filter installed on an Ethernet device may later classify packets on a headerless device through a shared block. The device association is not fixed at filter creation time. Fix this by gating the memcpy on dev->type == ARPHRD_ETHER, which ensures only true Ethernet-framed packets have their addresses read. This is more precise than the previous hard_header_len >= 12 check, which would incorrectly pass for non-Ethernet link types like IPoIB (ARPHRD_INFINIBAND, hard_header_len=24) and FDDI (hard_header_len=21) whose L2 headers are not in Ethernet format. Additionally check skb_mac_header_was_set() to guard against the pathological case where mac_header is the unset sentinel (~0U), which would cause eth_hdr() to return a wild pointer. For the act_mirred redirect case (Ethernet packet redirected to a non-Ethernet device sharing a TC block), zeroing the key is the correct behavior: the packet is now being classified on the target device, where Ethernet address matching is not semantically meaningful. Note: on non-Ethernet devices, the zeroed key will match a filter configured with all-zero MAC addresses. This is an improvement over the previous behavior where uninitialized memory could randomly match any filter.

References

NVD — CVE-2026-72444 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72444
git.kernel.org/stable/c/0fe6455b8e... WEB
https://git.kernel.org/stable/c/0fe6455b8e1a22414f39c07bc90a1df12b52ec74
git.kernel.org/stable/c/594c90b197... WEB
https://git.kernel.org/stable/c/594c90b197141944f25991b8314de5c26ee27a7e
git.kernel.org/stable/c/825de39f0c... WEB
https://git.kernel.org/stable/c/825de39f0c35a112148799b3cbe45af3766c018a
git.kernel.org/stable/c/9a65860959... WEB
https://git.kernel.org/stable/c/9a65860959db594dfc1820c7fdc09285fb7556bf
git.kernel.org/stable/c/bf6e8af2c8... WEB
https://git.kernel.org/stable/c/bf6e8af2c8be77489bedeae9f8a9654cb710e500
git.kernel.org/stable/c/c6d3bcb0f9... WEB
https://git.kernel.org/stable/c/c6d3bcb0f934d4297ac5fa1c8656ae40694fb601

Frequently Asked Questions

What is CVE-2026-72444?
CVE-2026-72444 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72444?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72444?
CVE-2026-72444 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-72444?
CVE-2026-72444 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72444?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2vpj-2c73-pm86",
  "modified" : "2026-08-17T06:33:30Z",
  "published" : "2026-08-15T06:32:24Z",
  "aliases" : [ "CVE-2026-72444" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nflow_dissector: check device type before reading ETH_ADDRS\n\n__skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb)\nwhen FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb\nhas a valid Ethernet header at mac_header, which is not always the case.\n\nThe problem can be triggered by:\n 1. Creating a TUN device in L3 mode (IFF_TUN, hard_header_len=0)\n 2. Attaching a multiq qdisc with a flower filter matching on eth_src\n 3. Sending a packet through AF_PACKET\n\nSince TUN in L3 mode has no link-layer header, mac_header points to\nthe L3 data area. The flow dissector reads 12 bytes of uninitialized\nskb memory, which then propagates through fl_set_masked_key() and is\nused as a rhashtable lookup key in __fl_lookup(), as reported by KMSAN.\n\nRejecting the filter in the control path (at tc filter add time) is\nnot feasible because TC filter blocks can be shared between arbitrary\ndevices -- a filter installed on an Ethernet device may later classify\npackets on a headerless device through a shared block. The device\nassociation is not fixed at filter creation time.\n\nFix this by gating the memcpy on dev->type == ARPHRD_ETHER, which\nensures only true Ethernet-framed packets have their addresses read.\nThis is more precise than the previous hard_header_len >= 12 check,\nwhich would incorrectly pass for non-Ethernet link types like IPoIB\n(ARPHRD_INFINIBAND, hard_header_len=24) and FDDI (hard_header_len=21)\nwhose L2 headers are not in Ethernet format. Additionally check\nskb_mac_header_was_set() to guard against the pathological case where\nmac_header is the unset sentinel (~0U), which would cause eth_hdr() to\nreturn a wild pointer.\n\nFor the act_mirred redirect case (Ethernet packet redirected to a\nnon-Ethernet device sharing a TC block), zeroing the key is the correct\nbehavior: the packet is now being classified on the target device, where\nEthernet address matching is not semantically meaningful.\n\nNote: on non-Ethernet devices, the zeroed key will match a filter\nconfigured with all-zero MAC addresses. This is an improvement over the\nprevious behavior where uninitialized memory could randomly match any\nfilter.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72444"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0fe6455b8e1a22414f39c07bc90a1df12b52ec74"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/594c90b197141944f25991b8314de5c26ee27a7e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/825de39f0c35a112148799b3cbe45af3766c018a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9a65860959db594dfc1820c7fdc09285fb7556bf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bf6e8af2c8be77489bedeae9f8a9654cb710e500"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c6d3bcb0f934d4297ac5fa1c8656ae40694fb601"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:18Z"
  }
}