netfilter: nfnetlink_osf: fix out-of-bounds read on option matching_CVE-2026-52999

9.1 / 10

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once
and passed by reference to nf_osf_match_one() for each fingerprint
checked. During TCP option parsing, nf_osf_match_one() advances the
shared ctx->optp pointer.

If a fingerprint perfectly matches, the function returns early without
restoring ctx->optp to its initial state. If the user has configured
NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.
However, because ctx->optp was not restored, the next call to
nf_osf_match_one() starts parsing from the end of the options buffer.
This causes subsequent matches to read garbage data and fail
immediately, making it impossible to log more than one match or logging
incorrect matches.

Instead of using a shared ctx->optp pointer, pass the context as a
constant pointer and use a local pointer (optp) for TCP option
traversal. This makes nf_osf_match_one() strictly stateless from the
caller's perspective, ensuring every fingerprint check starts at the
correct option offset.

AI Analysis

AI processing failed - invalid JSON response

Basic Information

ID CVE-2026-52999

Source Linux

Published Jun 24, 2026 at 16:29

Modified Jun 28, 2026 at 06:37

Affected Product

Vendor Linux

Product Linux

Version 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b

Affected Versions Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b
Linux Linux 0c1054e0e5fdef2369fb089e94def978bd209e1f
Linux Linux 8316b60582facd4068fb0916c4db2418c21b7174
Linux Linux 4.19.26
Linux Linux 4.20.13
Linux Linux 5.0

References

{
    "lastseen": "",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix out-of-bounds read on option matching\n\nIn nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once\nand passed by reference to nf_osf_match_one() for each fingerprint\nchecked. During TCP option parsing, nf_osf_match_one() advances the\nshared ctx->optp pointer.\n\nIf a fingerprint perfectly matches, the function returns early without\nrestoring ctx->optp to its initial state. If the user has configured\nNF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.\nHowever, because ctx->optp was not restored, the next call to\nnf_osf_match_one() starts parsing from the end of the options buffer.\nThis causes subsequent matches to read garbage data and fail\nimmediately, making it impossible to log more than one match or logging\nincorrect matches.\n\nInstead of using a shared ctx->optp pointer, pass the context as a\nconstant pointer and use a local pointer (optp) for TCP option\ntraversal. This makes nf_osf_match_one() strictly stateless from the\ncaller's perspective, ensuring every fingerprint check starts at the\ncorrect option offset.",
    "published": "2026-06-24T16:29:11.757Z",
    "modified": "2026-06-28T06:37:49.457Z",
    "type": "cve",
    "title": "netfilter: nfnetlink_osf: fix out-of-bounds read on option matching",
    "source": "Linux",
    "references": "https://git.kernel.org/stable/c/0145548346c4a30981a870a8ca00eac46ba27e85\nhttps://git.kernel.org/stable/c/1c136f2c44a5913646bac85303612fd0825197a0\nhttps://git.kernel.org/stable/c/1e19a07291bb8682c14c39a64725a3ae54ab8ccc\nhttps://git.kernel.org/stable/c/32e50f92c7cf3f4eba29622179a5fcdc2aebab41\nhttps://git.kernel.org/stable/c/70a3f31d25cf2ec9d4ddfa408120171ead955623\nhttps://git.kernel.org/stable/c/21883587593d7c8bb519a79460a0b5bc5ffbdabd\nhttps://git.kernel.org/stable/c/edb78a142d2e5948e63647c0646aa7e7886935f0\nhttps://git.kernel.org/stable/c/f5ca450087c3baf3651055e7a6de92600f827af3",
    "id": "CVE-2026-52999",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "Linux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b\nLinux Linux 0c1054e0e5fdef2369fb089e94def978bd209e1f\nLinux Linux 8316b60582facd4068fb0916c4db2418c21b7174\nLinux Linux 4.19.26\nLinux Linux 4.20.13\nLinux Linux 5.0",
    "sourceHref": "",
    "cvss": {
        "score": 9.1,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Linux",
    "version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
    "vendor": "Linux",
    "ai_description": "AI processing failed - invalid JSON response",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}