CVE-2026-97417

Received Received - Intake

Linux Kernel TCP SACK Option Handling Memory Alignment Issue

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped. This matches the existing get_unaligned_be32() use later in the same function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97417

EUVD

EUVD-2026-86030

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves unsafe memory access in the netfilter connection tracking subsystem. The issue occurs in the TCP selective acknowledgment (SACK) handling code where a pointer is incorrectly dereferenced assuming 4-byte alignment. This can lead to undefined behavior or crashes when processing malformed TCP options.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter connection tracking subsystem. Detection requires checking the kernel version and examining the affected function tcp_sack() in the nf_conntrack module. Use uname -a to check kernel version and grep for the vulnerable code pattern in the kernel source or running system.

Impact Analysis

If exploited, this flaw could cause kernel crashes or unexpected behavior in network traffic handling. Systems relying on netfilter for firewalling or NAT might become unstable. However, exploitation requires specific network conditions and malformed TCP packets.

Compliance Impact

This vulnerability affects compliance with standards and regulations like GDPR and HIPAA by potentially exposing sensitive data through memory corruption or improper handling of network traffic. Unauthorized access or data leaks could violate confidentiality requirements under these regulations.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the nf_conntrack tcp_sack() function. If immediate patching is not possible, consider disabling TCP SACK support via sysctl net.ipv4.tcp_sack=0 as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-97417. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70