Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem that could allow a local user to crash the system. The issue exists in the Netfilter component, which handles network traffic filtering and firewall rules. By providing an unexpectedly large list of options when configuring firewall rules, an attacker can trigger a system error, leading to a denial-of-service condition.
Technical details
An out-of-bounds array access vulnerability exists in net/ipv6/netfilter/ip6t_hbh.c within the Linux kernel. The 'struct ip6t_opts' structure uses a fixed-size array defined by IP6T_OPTS_OPTSNR (16), but the hbh_mt6_check() function failed to validate the 'optsnr' value provided by userspace during rule installation. A local attacker with the ability to modify ip6tables rules can provide a value greater than 16, leading to an off-by-one or greater out-of-bounds access during packet matching. This has been resolved by adding a check in the checkentry path to reject oversized option lists.
Affected products
- Linux Linux 2.6.12-rc2 to 6.13
Timeline
- 2026-05-13: other: Patch authored
- 2026-06-24: advisory: CVE published
References
- https://git.kernel.org/stable/c/2d523ba48d4ecc46acfb6aba548292cfcce1ac02
- https://git.kernel.org/stable/c/41ec2e242f1702e8370ddfe14d22b7a766021c3e
- https://git.kernel.org/stable/c/4322dcde6b4173c2d8e8e6118ed290794263bcc8
- https://git.kernel.org/stable/c/57b0ac5e1b46f1f0338dff392ef2092e2871b412
- https://git.kernel.org/stable/c/588933f1a2ca5ff99274f8c9f25dc3a25d0191c3
- https://git.kernel.org/stable/c/6feb43c0995ab3a9c826707eb46541a1696fe4f7
- https://git.kernel.org/stable/c/784aadea7a108c9f90985683caa87fb0198c6a39