{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43452", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.010Z", "datePublished": "2026-05-08T14:22:17.361Z", "dateUpdated": "2026-08-05T12:28:01.123Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:01.123Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i == optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - In a reasonable highest-impact deployment, an internet-facing host or firewall has an x_tables TCP/DCCP option match rule installed, and the vulnerable walker is then reached by unauthenticated network packets. A remote attacker can craft TCP or DCCP options ending with a non-single-byte option kind to trigger the tail read.\nAC:L - The trigger is deterministic packet content: make the last option byte a kind value >= 2 without a following length byte. There is no race, timing requirement, or attacker-uncontrolled memory layout condition needed to reach the bug.\nPR:N - The network packet path requires no local account or authentication once the affected rule is present. Although local rule installation is gated by CAP_NET_ADMIN in the network namespace and is user-namespace reachable, the highest reasonable trigger path is unauthenticated remote traffic.\nUI:N - No victim user action is required for each exploit attempt. The attacker only sends crafted packets to a system whose netfilter rules inspect TCP or DCCP options.\nS:U - The vulnerable code executes in the target kernel’s own netfilter packet-processing context. It does not cross a separate security authority such as a VM or device/IOMMU boundary.\nC:L - The primitive is a strictly bounded one-byte out-of-bounds read past the option area, not an arbitrary read primitive. Because it can access adjacent kernel memory, limited confidentiality impact is the higher defensible value.\nI:N - The bug performs only an out-of-bounds read of op[i + 1]; it does not write memory or corrupt kernel structures. The read byte only affects loop advancement at the tail and does not provide an integrity-changing primitive.\nA:H - Malformed packets can repeatedly trigger a kernel out-of-bounds read in the netfilter hot path. On hardened, sanitizing, or faulting deployments this can produce an oops or panic, so availability impact is high." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/xt_dccp.c", "net/netfilter/xt_tcpudp.c" ], "versions": [ { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "c2a445367a496a3c25dbc940c10c8bd1cfd4c14a", "status": "affected", "versionType": "git" }, { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "ae1e1267650638136b84c23f2b31250f0ccb6823", "status": "affected", "versionType": "git" }, { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "c39f84e4be1be63fc60ca7141ea7b76edcea5907", "status": "affected", "versionType": "git" }, { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "9b94f0e42ed248eb31929da84ed9f5310d7ff540", "status": "affected", "versionType": "git" }, { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c", "status": "affected", "versionType": "git" }, { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "bc18551c6169eac5ed813778d3e3e484002dbbe5", "status": "affected", "versionType": "git" }, { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "d04800323336eebf441d153f43234eac9b833d36", "status": "affected", "versionType": "git" }, { "version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc", "lessThan": "cfe770220ac2dbd3e104c6b45094037455da81d4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/xt_dccp.c", "net/netfilter/xt_tcpudp.c" ], "versions": [ { "version": "2.6.16", "status": "affected" }, { "version": "0", "lessThan": "2.6.16", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.1.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.6.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.12.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.18.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.19.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c2a445367a496a3c25dbc940c10c8bd1cfd4c14a" }, { "url": "https://git.kernel.org/stable/c/ae1e1267650638136b84c23f2b31250f0ccb6823" }, { "url": "https://git.kernel.org/stable/c/c39f84e4be1be63fc60ca7141ea7b76edcea5907" }, { "url": "https://git.kernel.org/stable/c/9b94f0e42ed248eb31929da84ed9f5310d7ff540" }, { "url": "https://git.kernel.org/stable/c/5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c" }, { "url": "https://git.kernel.org/stable/c/bc18551c6169eac5ed813778d3e3e484002dbbe5" }, { "url": "https://git.kernel.org/stable/c/d04800323336eebf441d153f43234eac9b833d36" }, { "url": "https://git.kernel.org/stable/c/cfe770220ac2dbd3e104c6b45094037455da81d4" } ], "title": "netfilter: x_tables: guard option walkers against 1-byte tail reads", "x_generator": { "engine": "bippy-1.2.0" } } } }