CVE-2026-23397
Out-of-Bounds Read in Linux nfnetlink_osf Causes Kernel Crash
Publication date: 2026-03-26
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 2.6.31 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.167 (exc) |
| linux | linux_kernel | From 2.6.31.1 (inc) to 5.10.253 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.78 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.20 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's nfnetlink_osf module, which handles fingerprint matching for network packets.
The issue arises because the function nfnl_osf_add_callback() validates some aspects of options like their number and string termination, but it does not check the length of individual options.
If an option has zero length, the matching function nf_osf_match_one() enters a loop expecting options even when there are none, leading to a null pointer dereference and a general protection fault (kernel crash).
Additionally, if the MSS (Maximum Segment Size) TCP option has a length less than 4 bytes, nf_osf_match_one() reads out-of-bounds memory because it assumes the MSS option is always exactly 4 bytes as per RFC 9293.
The fix involves rejecting fingerprints with zero-length options or MSS options shorter than 4 bytes during the addition phase, preventing unsafe packet matching later.
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash (general protection fault) due to null pointer dereference when processing specially crafted network packets.
Such crashes can lead to denial of service (DoS) conditions on affected Linux systems, potentially disrupting network services or other critical operations.
In addition, out-of-bounds memory reads caused by malformed MSS options could potentially expose kernel memory contents, although the description does not explicitly confirm information disclosure.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by rejecting fingerprints where any option has zero length or where an MSS option has length less than 4 at add time rather than trusting these values in the packet matching hot path.
Therefore, immediate mitigation steps include updating the Linux kernel to a version where this fix is applied to ensure proper validation of option lengths in nfnetlink_osf.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the Linux kernel's nfnetlink_osf module improperly validating TCP fingerprint options, which can cause kernel crashes or memory safety issues.
Detection would involve monitoring for kernel oops or crashes related to nf_osf_match_one or nfnetlink_osf components, especially general protection faults or null pointer dereferences in the kernel logs.
You can check your kernel logs for such errors using commands like:
- dmesg | grep -i 'nf_osf_match_one'
- journalctl -k | grep -i 'nf_osf_match_one'
- grep -i 'general protection fault' /var/log/kern.log
Additionally, monitoring for suspicious TCP packets with malformed TCP options (zero-length options or MSS options with length less than 4) could help detect attempts to trigger this vulnerability, but specific packet capture filters or scripts would need to be developed for this purpose.