Division by Zero Vulnerability in Linux Kernel's Netfilter Component

CVE-2026-45841

What is CVE-2026-45841?

In the Linux kernel, a vulnerability exists within the netfilter's nfnetlink_osf module, which can lead to a critical divide-by-zero error during TCP SYN packet processing. When a user with CAP_NET_ADMIN privileges adds a fingerprint with an invalid window size value, it causes a kernel panic. An attacker could exploit this flaw by introducing a malformed fingerprint, leading to a crash of the kernel when matched TCP SYN packets are processed. The issue has been addressed by implementing necessary checks in the nf_osf_match_one() function to prevent the divide-by-zero scenario, thereby enhancing the overall stability and security of the kernel.

References