Vulnerability in Linux Kernel's Netfilter Affects Option Handling

CVE-2026-52915

What is CVE-2026-52915?

The vulnerability in the Linux Kernel's Netfilter affects the handling of option lists within the ip6t_hbh component. It arises from the inability to properly reject oversized options provided from userspace, potentially leading to an off-by-one array access. The struct ip6t_opts is designed with a fixed limit for option descriptors, but without sufficient validation, attackers may exploit this flaw, impacting the integrity and security of packet matching. Proper validation mechanisms have been established in the rule setup path to prevent oversized input, which is critical for maintaining the stability and security of the kernel's networking features.

References