Executive brief
A vulnerability in the Linux kernel's networking component could allow unprivileged applications to manipulate how data packets are routed. By using specific IP routing options, an attacker could force traffic through a server they control to intercept sensitive connection details, such as TCP sequence numbers. This could potentially lead to further network-based attacks or data leakage.
Technical details
A vulnerability in net/ipv4/ip_options.c in the Linux kernel allowed unprivileged applications to set IPOPT_SSRR and IPOPT_LSRR options. These IPv4 options enable source routing, which can be abused to force packets through attacker-controlled intermediate nodes. This exposure allows for the leakage of TCP Initial Sequence Numbers (ISNs) and other protocol metadata. The fix restricts these options to users with the CAP_NET_RAW capability, aligning with RFC 7126 recommendations to drop or restrict these options. The vulnerability affects versions dating back to the 2.6.12-rc2 release.
Affected products
- Linux Linux Kernel 2.6.12 to 6.9.x
Timeline
- 2026-06-02: other: Patch submitted by Eric Dumazet
- 2026-06-19: patched: Commits merged into stable branches
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/00e8845fe3428c69e980dce5071cb3da1d8f7578
- https://git.kernel.org/stable/c/28f5ad1b4055405eb1616e603fe511ba5e3725e7
- https://git.kernel.org/stable/c/2a87c3e8f03ce655ed0ef500d64d5fd924ec3691
- https://git.kernel.org/stable/c/4cd6e9ed49347d3a2fdaaf07e32fb524756dddc2
- https://git.kernel.org/stable/c/89343ff12b3178fc236fe531a3603e7c97c68278
- https://git.kernel.org/stable/c/8ff85dbabbbfb05e86e6cde31d91ac5782179d4d
- https://git.kernel.org/stable/c/a4f3fd6516920988c47ba8d19714985c40c816a1