PT-2026-51708 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-52915

NVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t hbh: reject oversized option lists

struct ip6t opts stores at most IP6T OPTS OPTSNR option descriptors, but hbh mt6 check() does not reject larger optsnr values supplied from userspace.

Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged.

struct ip6t opts has a fixed opts[IP6T OPTS OPTSNR] array, where IP6T OPTS OPTSNR is 16, then off-by-one array access is possible:

[ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type ' u16 [16]'

Related Identifiers

CVE-2026-52915

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-52915 · Security Note
• https://git.kernel.org/stable/c/db0250470f023f159094052c0bd5ab026a88ae93 · Note
• https://git.kernel.org/stable/c/57b0ac5e1b46f1f0338dff392ef2092e2871b412 · Note
• https://git.kernel.org/stable/c/41ec2e242f1702e8370ddfe14d22b7a766021c3e · Note
• https://git.kernel.org/stable/c/4322dcde6b4173c2d8e8e6118ed290794263bcc8 · Note
• https://git.kernel.org/stable/c/2d523ba48d4ecc46acfb6aba548292cfcce1ac02 · Note
• https://git.kernel.org/stable/c/588933f1a2ca5ff99274f8c9f25dc3a25d0191c3 · Note
• https://git.kernel.org/stable/c/784aadea7a108c9f90985683caa87fb0198c6a39 · Note
• https://git.kernel.org/stable/c/6feb43c0995ab3a9c826707eb46541a1696fe4f7 · Note