PT-2026-46007 · Linux · Linux

Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-46244

NVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft inner: Fix IPv6 inner thoff desync

In nft inner parse l2l3(), when processing inner IPv6 packets, ipv6 find hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof( ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2.

For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6 find hdr()'s result. Removing the incorrect overwrite ensures that ipv6 find hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

Related Identifiers

CVE-2026-46244

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46244 · Security Note
• https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce · Note
• https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c · Note
• https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601 · Note
• https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273 · Note
• https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582 · Note