Executive brief
A vulnerability in the Linux kernel's network packet filtering subsystem (netfilter) allows malformed IP headers to trigger out-of-bounds memory access. An attacker sending specially crafted network packets could cause a kernel crash or potentially execute code with kernel privileges, disrupting network service or compromising system integrity.
Technical details
The vulnerability is an out-of-bounds memory access in the nf_flow_ip4_tunnel_proto() function in net/netfilter/nf_flow_table_ip.c. The function failed to validate the iph->ihl field (IP header length) before using it to compute buffer size, allowing a malformed IP packet with an invalid ihl value to cause out-of-bounds access. The fix adds a sanity check requiring iph->ihl >= 5 (minimum valid header length) before processing. The vulnerability requires network reachability to send malformed packets to the target system, and no authentication is needed. An attacker can trigger a denial of service or potential code execution via crafted IPIP tunnel packets.
Affected products
- Linux Linux kernel all versions with ab427db178858 and before 2026-06-08
Timeline
- 2026-08-15: disclosed: Public disclosure via NVD
- 2026-06-08: patched: Fix committed by Lorenzo Bianconi
- 2026-06-23: advisory: Patch merged into mainline