CVE-2026-52915

Analyzed Analyzed - Analysis Complete

Array Index Out of Bounds in Linux Kernel netfilter

Publication date: 2026-06-24

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_hbh: reject oversized option lists struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace. Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged. `struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array, where `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible: [ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]'

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-08

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52915

EUVD

EUVD-2026-38718

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 2.6.12.1 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the ip6t_hbh module. The issue arises because the struct ip6t_opts is designed to store a fixed number (16) of option descriptors, but the function hbh_mt6_check() does not properly reject larger numbers of options supplied from userspace. This can lead to an off-by-one array access error, where an index outside the bounds of the fixed-size array is accessed, potentially causing undefined behavior or memory corruption.

The fix involves validating the number of options (optsnr) during the rule setup phase to ensure only valid counts that fit within the fixed-size array are accepted, preventing invalid user-provided counts from being installed.

Impact Analysis

This vulnerability can lead to an out-of-bounds array access in the Linux kernel, which may cause memory corruption or instability in the system. Such behavior could potentially be exploited by an attacker to cause a denial of service (system crash) or possibly execute arbitrary code with kernel privileges, depending on the context and exploitability.

Hi! I’m here to help you understand CVE-2026-52915. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70