01 Record

CVE-2026-23397

nfnetlink_osf: validate individual option lengths in fingerprints

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

nfnetlink_osf: validate individual option lengths in fingerprints

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.12% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 2.4% of scored records. A rank, not a probability.
NVD base score: 7.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-14.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-03-26 10:22Z5 MO AGO

Last updated

2026-07-14 12:46Z1 MO AGO

Reserved

2026-01-13

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-125Out-of-bounds ReadBase
CWE-130Improper Handling of Length Parameter InconsistencyBase

Data version

5.2

Document digest

833d2029cb6d15062420295aa975cb377e64cef4fd8aee65b1b01f56bdb5e88f

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < e9cf17b91e733fec725ebcc0b3098bc5ccd505e0, 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < 3c11b5c2436a3a5b450612ab160e3a525b28cfb5, 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < aa0574182c46963c3cdb8cde46ec93aca21100d8, 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < 224f4678812e1a7bc8341bcb666773a0aec5ea6f, 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < ec8bf0571b142f29dc0b68ae2ac3952f7a464b38, 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < 3932620c04c2938c93c0890c225960d3d34ba355, 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < 4c6aa008b913e808c4f4d3cde36cb1d9bb5967c6, 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to < dbdfaae9609629a9569362e3b8f33d0a20fd783c, 2.6.31—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/e9cf17b91e733fec725ebcc0b3098bc5ccd505e0
git.kernel.orghttps://git.kernel.org/stable/c/3c11b5c2436a3a5b450612ab160e3a525b28cfb5
git.kernel.orghttps://git.kernel.org/stable/c/aa0574182c46963c3cdb8cde46ec93aca21100d8
git.kernel.orghttps://git.kernel.org/stable/c/224f4678812e1a7bc8341bcb666773a0aec5ea6f
git.kernel.orghttps://git.kernel.org/stable/c/ec8bf0571b142f29dc0b68ae2ac3952f7a464b38
git.kernel.orghttps://git.kernel.org/stable/c/3932620c04c2938c93c0890c225960d3d34ba355
git.kernel.orghttps://git.kernel.org/stable/c/4c6aa008b913e808c4f4d3cde36cb1d9bb5967c6
git.kernel.orghttps://git.kernel.org/stable/c/dbdfaae9609629a9569362e3b8f33d0a20fd783c
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-019113.html

01 Record index

CVE-2026-23397

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2026-23397

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References