Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a privileged user to crash the entire system. The issue exists in the Netfilter component, which is responsible for firewalling and packet filtering. By providing a specially crafted network fingerprint, an administrator can trigger a kernel panic, leading to a complete denial of service.
Technical details
A divide-by-zero vulnerability exists in the nf_osf_match_one() function within net/netfilter/nfnetlink_osf.c. The root cause is a lack of validation for the f->wss.val field when the OSF_WSS_MODULO branch is executed, allowing a modulo operation by zero. An attacker with CAP_NET_ADMIN privileges can inject a malicious fingerprint via nfnetlink. When a subsequent TCP SYN packet matches this fingerprint, the kernel performs the invalid division and panics. The fix involves adding validation in nfnl_osf_add_callback() to reject fingerprints where wss.val is zero or wss.wc exceeds OSF_WSS_MAX.
Affected products
- Linux Linux Kernel Fixed in 2195574dc6d9017d32ac346987e12659f931d932, 8def8fbd23f40e945febe913d04b731012ce0082, 9a05e195618a6d474f2bcd5b6376d0ffc2f00366, c55940895245d8ef658ab381248a28755218d625, fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f
Timeline
- 2026-04-14: other: Patch authored
- 2026-05-27: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932
- https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082
- https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366
- https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625
- https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f