Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow attackers to bypass firewall rules. The issue exists in the Netfilter component, which is responsible for filtering network traffic. By sending specially crafted IPv6 packets, an attacker might trick the system into misidentifying the start of network data, potentially allowing unauthorized traffic to pass through the firewall.
Technical details
A logic error in nft_inner_parse_l2l3() causes a desynchronization between the transport header offset (inner_thoff) and the layer 4 protocol (l4proto) when processing inner IPv6 packets. While ipv6_find_hdr() correctly calculates the offset by traversing extension headers, the result is incorrectly overwritten with a fixed 40-byte offset (base header only). This allows an attacker to forge transport headers or bypass firewall policies that rely on inner tunnel header matching. The vulnerability affects Linux kernel versions 6.2 and later and has been patched in various stable branches.
Affected products
- Linux Linux Kernel 6.2 and later
Timeline
- 2026-05-12: other: Patch authored
- 2026-06-03: disclosed: CVE published
References
- https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601
- https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582
- https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c
- https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273
- https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce