{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_inner: Fix IPv6 inner_thoff desync\\n\\nIn nft_inner_parse_l2l3(), when processing inner IPv6 packets,\\nipv6_find_hdr() correctly computes the transport header offset\\ntraversing all extension headers, but the result is immediately\\noverwritten with nhoff + sizeof(_ip6h) (40 bytes), which only\\naccounts for the IPv6 base header. This creates a desync between\\ninner_thoff (wrong \u2014 points to extension header start) and l4proto\\n(correct \u2014 e.g., IPPROTO_TCP), enabling transport header forgery\\nand potential firewall bypass. This issue affects stable versions\\nfrom Linux 6.2.\\n\\nFor comparison, the normal (non-inner) IPv6 path correctly\\npreserves ipv6_find_hdr()’s result. Removing the incorrect overwrite\\nensures that ipv6_find_hdr()’s calculated transport header offset is\\npreserved, thereby fixing the desynchronization.”,”published”:”2026-06-03T15:48:59.049Z”,”modified”:”2026-06-05T06:06:19.081Z”,”type”:”cve”,”title”:”netfilter: nft_inner: Fix IPv6 inner_thoff desync”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/c161ad9157f5a0429b5ff94d9770faf3bf48d273\\nhttps:\/\/git.kernel.org\/stable\/c\/870d59e2cf218e7418491e26bad768cb16654582\\nhttps:\/\/git.kernel.org\/stable\/c\/689bbf48c1f45130086ae1c46ab83ea4c753c601\\nhttps:\/\/git.kernel.org\/stable\/c\/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce\\nhttps:\/\/git.kernel.org\/stable\/c\/b6a91f68ebfed9c38e0e9150f58a9b85da07181c”,”id”:”CVE-2026-46244″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 3a07327d10a09379315c844c63f27941f5081e0a\\nLinux Linux 3a07327d10a09379315c844c63f27941f5081e0a\\nLinux Linux 3a07327d10a09379315c844c63f27941f5081e0a\\nLinux Linux 3a07327d10a09379315c844c63f27941f5081e0a\\nLinux Linux 3a07327d10a09379315c844c63f27941f5081e0a\\nLinux Linux 6.2″,”sourceHref”:””,”cvss”:{“score”:9.1,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”3a07327d10a09379315c844c63f27941f5081e0a”,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_inner: Fix IPv6 inner_thoff desync\\n\\nIn nft_inner_parse_l2l3(), when processing inner IPv6 packets,\\nipv6_find_hdr() correctly computes the transport…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,10,12,13,7,11,5],"class_list":["post-59979","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-91","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n