Junglewise Threat Intelligence

CVE-2026-23397: Linux Kernel null pointer dereference and OOB read in nfnetlink_osf

CVE-2026-23397 · Severity: high · CVSS 7.1 · Published 2026-03-26

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's network filtering system could allow a local user with administrative privileges to crash the system or access sensitive memory. The issue exists in the component that identifies operating systems based on network traffic patterns. By providing specially crafted, invalid fingerprint data, an attacker can trigger a system failure (kernel panic) or read data from unauthorized memory locations.

Technical details

A vulnerability in nfnetlink_osf (Passive OS fingerprinting) arises because nfnl_osf_add_callback() does not validate individual option length fields when adding new fingerprints. A zero-length option can trigger a null pointer dereference in nf_osf_match_one() when processing packets without TCP options. Additionally, an MSS (Maximum Segment Size) option with a length of less than 4 bytes leads to an out-of-bounds read when the kernel attempts to extract the MSS value. An attacker with CAP_NET_ADMIN privileges can exploit this to cause a denial-of-service (kernel oops) or potentially leak information from kernel memory. The issue has been addressed by adding strict length validation for all options at the time they are added to the fingerprint database.

Affected products

  • Linux Linux Kernel All versions prior to the March 2026 patches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-19: other: Patch authored
  • 2026-03-25: patched: Patches committed to stable trees
  • 2026-03-26: advisory: CVE published

References

Related threats