CVE-2026-52998

Awaiting Analysis Awaiting Analysis - Queue

NULL Dereference in Linux Kernel Netfilter nfnetlink_osf

Publication date: 2026-06-24

Last updated on: 2026-07-10

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching. Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttl_check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-10

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52998

EUVD

EUVD-2026-38866

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the nfnetlink_osf module. The nf_osf_ttl() function accessed a device pointer (skb->dev) without verifying if it was valid, which could lead to a NULL pointer dereference.

Additionally, the function used a loop to match packet source addresses against local interface addresses, assuming packets from the same subnet should not have their TTL decremented. However, in modern environments with containers and virtual switching, packets might appear to be from the same subnet but actually are not.

The fix involved removing the unsafe device dereference and the interface loop, replacing the logic with a switch statement that evaluates the TTL according to the ttl_check.

Impact Analysis

This vulnerability could cause a NULL pointer dereference in the Linux kernel, potentially leading to a kernel crash or denial of service. This may affect system stability and availability, especially in environments using containers or virtual networking.

Mitigation Strategies

The vulnerability has been resolved by fixing the nfnetlink_osf component in the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue.

Hi! I’m here to help you understand CVE-2026-52998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70