Executive brief
A vulnerability in the Linux kernel's networking subsystem can cause network connections to fail when using specific firewall and address translation (NAT) rules. This primarily affects the FTP protocol, where the system may fail to correctly adjust network traffic sequences after modifying packet data. For businesses, this could lead to service disruptions or the inability to transfer files securely through firewalls or industrial controllers that rely on this software.
Technical details
A vulnerability exists in the Linux kernel netfilter subsystem (nft_ct) where the 'seqadj' extension is not properly added for NATed connections when a conntrack helper is assigned. This occurs specifically when the FTP helper is assigned after the Destination NAT (DNAT) setup. Because FTP PASV/EPSV modes require rewriting packet payloads (IP and port), the TCP sequence and acknowledgement numbers must be adjusted. Without the seqadj extension, the kernel triggers a warning in 'nf_conntrack_seqadj.c' and fails to mangle the TCP packets correctly, resulting in dropped connections. The fix ensures the required extension is added when a conntrack helper is assigned to a connection with an existing NAT binding.
Affected products
- Linux Linux Kernel Fixed in 6.12.y and other stable branches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2025-10-24: other: Patch authored
- 2025-12-16: disclosed: CVE published
- 2026-07-14: advisory: Siemens advisory updated
References
- https://git.kernel.org/stable/c/2b52d89cbbb0dbe3e948d8d9a91e704316dccfe6
- https://git.kernel.org/stable/c/4ab2cd906e4e1a19ddbda6eb532851b0e9cda110
- https://git.kernel.org/stable/c/4de80f0dc3868408dd7fe9817e507123c9dd8bb0
- https://git.kernel.org/stable/c/83273af0b60c093ba0085c205864d8542e1b1653
- https://git.kernel.org/stable/c/90918e3b6404c2a37837b8f11692471b4c512de2
- https://git.kernel.org/stable/c/b19492c25eff04852e0cb58f9bb8238b6695ed2d
- https://git.kernel.org/stable/c/b477ef7fa612fa45b6b3134d90d1eeb09396500a