The Linux kernel vulnerability CVE-2026-72250 affects the netfilter nf_conntrack_reasm component responsible for IPv6 fragment reassembly. The function nf_ct_frag6_reasm() unconditionally advances the skb->mac_header offset after removing the IPv6 fragment header. On the NF_INET_LOCAL_OUT defragmentation path, skb->mac_header is initially unset (~0U). Adding the fragment header size causes the offset to wrap, leading skb_mac_header_was_set() to incorrectly report a MAC header presence and skb_mac_header() to point into packet headroom. This was harmless when mac_header was a pointer but became problematic after it changed to a u16 offset. The fix introduces a guard to prevent this incorrect adjustment, mirroring the approach in net/ipv6/reassembly.c.

The vulnerability causes incorrect handling of the mac_header offset in IPv6 packet reassembly, potentially leading to misinterpretation of packet headers. The description does not specify direct exploitation consequences such as privilege escalation or denial of service. No known exploits are reported in the wild. The impact appears limited to incorrect internal kernel state handling during IPv6 defragmentation.

A fix has been implemented in the Linux kernel to guard the mac_header adjustment after IPv6 defragmentation in nf_conntrack_reasm. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.