Cloudanix VulnDB

CVE-2026-23397

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Mar 26, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's network processing can let someone crash servers or peek at memory by sending certain network packets, risking outages and data leaks until fixed kernels are installed.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing validation of individual TCP option lengths in nfnetlink_osf fingerprints allows zero-length options to trigger null pointer dereference in nf_osf_match_one or out-of-bounds reads when parsing MSS options shorter than 4 bytes during packet matching in the netfilter hot path.

Why it matters to the business

Linux systems may experience kernel crashes or memory corruption when processing network traffic, leading to denial of service, potential data exposure, and unplanned downtime for servers and network appliances.

How an attack unfolds

An attacker with local access crafts a malicious OS fingerprint containing zero-length options or invalid MSS lengths, registers it via nfnetlink, then sends matching TCP packets that reach the xt_osf match hook, causing the kernel to dereference NULL or read beyond bounds in the option parsing loop.

How to fix it

Apply the upstream kernel patch that adds length validation for every option at fingerprint registration time; rebuild and deploy the fixed kernel image across all affected distributions as soon as vendor updates become available.

How to confirm the fix worked

Confirm the patch is present by inspecting nfnetlink_osf.c for the new option length checks before the add callback returns; test by attempting to register invalid fingerprints and verifying they are rejected; monitor for absence of the described Oops and KASAN reports under crafted traffic.

Typical attack path

  1. Obtain local access on a Linux system with netfilter OS fingerprinting enabled
  2. Use nfnetlink to register a fingerprint with zero-length options or MSS length < 4
  3. Send TCP packets engineered to match the fingerprint and trigger the matching code path
  4. Trigger null pointer dereference or out-of-bounds read resulting in Oops or KASAN report

How to detect it

Search kernel logs and crash dumps for the exact call trace containing nf_osf_match_one, nf_osf_match, and xt_osf_match_packet; correlate with nfnetlink messages that add fingerprints and any preceding Oops or general protection fault entries.

What your security team should do

  • Prioritize kernel updates on all internet-facing and internal Linux hosts that use xt_osf or nfnetlink_osf
  • Disable OS fingerprint matching modules if the functionality is not required until patches are applied
  • Monitor vendor advisories for distribution-specific fixed kernel versions and schedule immediate rollout

The record

In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter the option matching loop even when foptsize sums to zero, which matches packets with no TCP options where ctx->optp is NULL: Oops: general protection fault KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: nf_osf_match (net/netfilter/nfnetlink_osf.c:227) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:293) nf_hook_slow (net/netfilter/core.c:623) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) Additionally, an MSS option (kind=2) with length < 4 causes out-of-bounds reads when nf_osf_match_one() unconditionally accesses optp[2] and optp[3] for MSS value extraction. While RFC 9293 section 3.2 specifies that the MSS option is always exactly 4 bytes (Kind=2, Length=4), the check uses "< 4" rather than "!= 4" because lengths greater than 4 do not cause memory safety issues -- the buffer is guaranteed to be at least foptsize bytes by the ctx->optsize == foptsize check. Reject fingerprints where any option has zero length, or where an MSS option has length less than 4, at add time rather than trusting these values in the packet matching hot path.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities