Executive brief
The Linux kernel's netfilter synproxy module processes TCP timestamps during connection proxying without proper alignment handling. On systems with strict memory alignment requirements, this can cause crashes or performance degradation. Attackers exploiting this could disrupt network traffic filtering and proxy functionality used in firewalls and load balancers.
Technical details
The vulnerability is an unaligned memory access bug in the synproxy_tstamp_adjust() function within net/netfilter/nf_synproxy_core.c. The code directly casts and dereferences a pointer to timestamp fields without accounting for alignment constraints, causing crashes on strict-alignment architectures (ARM, SPARC) and performance degradation on others. An attacker can trigger this by sending crafted TCP packets with timestamp options that reach the synproxy module. The fix uses get_unaligned_be32() and put_unaligned_be32() accessor functions to safely read and write the misaligned timestamp values. Patches are available in upstream kernel commit 992c20bc8a4aba220c8b95b467d049289778dad6.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 7.2
Timeline
- 2026-08-28: disclosed
- 2026-05-26: patched: Fix commit 992c20bc8a4aba220c8b95b467d049289778dad6 authored