Executive brief
A vulnerability in the Linux kernel's networking component could cause incorrect firewall decisions on systems using FireWire (IEEE1394) interfaces. Because the system misinterprets network traffic data on these specific interfaces, security rules might fail to block unauthorized traffic or accidentally drop legitimate data. This could lead to minor network instability or a bypass of intended security filters on affected hardware.
Technical details
A vulnerability exists in the 'arp_tables' component of the Linux kernel's netfilter subsystem. The function 'arp_packet_match()' incorrectly assumes that all ARP payloads contain both source and target hardware addresses; however, RFC 2734 (IPv4-over-IEEE1394) omits the target hardware address. This discrepancy causes the parser to read incorrect offsets for target device and IP addresses, matching rules against 'garbage' data. Additionally, 'arpt_mangle' uses linear pointer arithmetic that miscalculates offsets on these interfaces, potentially writing mangled data to the wrong memory locations. The fix introduces specific checks for ARPHRD_IEEE1394 to skip the nonexistent target hardware address and drops packets if mangling is attempted on unsupported fields for these devices.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-20: patched: Initial patch authored by Pablo Neira Ayuso
- 2026-05-27: advisory: CVE-2026-45844 published in NVD
References
- https://git.kernel.org/stable/c/03ea11dbefaa55c502735ee551c89ef773fe753b
- https://git.kernel.org/stable/c/1c55053f8ffdc060006df898fd3664e3d1bfac7b
- https://git.kernel.org/stable/c/1e8e3f449b1e73b73a843257635b9c50f0cc0f0a
- https://git.kernel.org/stable/c/ac698d81fd6619c7504cee913f1cab5285fba1b7
- https://git.kernel.org/stable/c/ad9973df8e0eeb123d9ec4d18828e05b7d44ff4b