Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause undefined system behavior or a crash. The issue exists in the component responsible for managing network connection states (conntrack), where certain configuration values were not properly restricted. This could lead to a denial-of-service, impacting the availability of affected systems, including certain Siemens industrial controllers that utilize the Linux kernel.
Technical details
A vulnerability in the ctnetlink component of the Linux kernel netfilter subsystem stems from insufficient validation of Netlink attributes. Specifically, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL and REPLY attributes accepted values between 0-255, whereas the TCP protocol maximum is 14. When an out-of-range value is used as a shift count for a u32 variable, it results in undefined behavior. Additionally, CTA_PROTOINFO_TCP_STATE lacked strict range checking at the policy level. An attacker with local access to Netlink sockets could exploit this to cause kernel instability or a denial-of-service. The fix implements NLA_POLICY_MAX and NLA_POLICY_MASK annotations to ensure the Netlink core rejects invalid values before they reach the conntrack logic.
Affected products
- Linux Linux Kernel All versions prior to the April 2026 patches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2026-03-25: other: Patch authored
- 2026-04-22: disclosed: CVE published
- 2026-07-14: advisory: Siemens advisory updated with affected industrial products
References
- https://git.kernel.org/stable/c/2ef71307c86a9f866d6e28f1a0c06e2e9d794474
- https://git.kernel.org/stable/c/435b576cd2faa75154777868f8cbb73bf71644d3
- https://git.kernel.org/stable/c/45c33e79ae705b7af97e3117672b6cd258dd0b1b
- https://git.kernel.org/stable/c/4f7d25f3f0786402ba48ff7d13b6241d77d975f5
- https://git.kernel.org/stable/c/675c913b940488a84effdeeac5a1cfb657b59804
- https://git.kernel.org/stable/c/8f15b5071b4548b0aafc03b366eb45c9c6566704
- https://git.kernel.org/stable/c/c6cb41eaae875501eaaa487b8db6539feb092292