CVE-2026-52998
Received Received - Intake
NULL Dereference in Linux Kernel Netfilter nfnetlink_osf

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching. Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttl_check.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-52998
EUVD
EUVD-2026-38866
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

This vulnerability could cause a NULL pointer dereference in the Linux kernel, potentially leading to a kernel crash or denial of service. This may affect system stability and availability, especially in environments using containers or virtual networking.

Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the nfnetlink_osf module. The nf_osf_ttl() function accessed a device pointer (skb->dev) without verifying if it was valid, which could lead to a NULL pointer dereference.

Additionally, the function used a loop to match packet source addresses against local interface addresses, assuming packets from the same subnet should not have their TTL decremented. However, in modern environments with containers and virtual switching, packets might appear to be from the same subnet but actually are not.

The fix involved removing the unsafe device dereference and the interface loop, replacing the logic with a switch statement that evaluates the TTL according to the ttl_check.

Mitigation Strategies

The vulnerability has been resolved by fixing the nfnetlink_osf component in the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52998. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart