PT-2026-46007 · Linux+2 · Linux Kernel+2
CVSS v3.1
9.4
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 6.2 and later
Description
A desynchronization issue exists in the
nft inner parse l2l3() function when processing inner IPv6 packets. While the ipv6 find hdr() function correctly calculates the transport header offset by traversing extension headers, this value is incorrectly overwritten by a calculation that only accounts for the IPv6 base header. This results in a mismatch between inner thoff, which incorrectly points to the start of the extension header, and l4proto, which correctly identifies the protocol (e.g., IPPROTO TCP). This discrepancy allows for transport header forgery and potential firewall bypass.Recommendations
Update to a version where the incorrect overwrite in the
nft inner parse l2l3() function has been removed to ensure the transport header offset is preserved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Rocky Linux