CVE-2026-43452

What it actually does

This is a Linux kernel netfilter/x_tables out-of-bounds read in the TCP and DCCP option-walking logic used by xt_tcpudp and xt_dccp. When a packet’s option area ends with a final byte that represents a multi-byte option kind, the walker can attempt to read the next byte as the option length even though no next byte exists. In vulnerable kernels, a remotely supplied malformed TCP or DCCP packet that reaches affected netfilter matching code can cause a one-byte read past the end of the option buffer. The most likely impact is kernel instability or crash, resulting in denial of service; limited information exposure may also be possible depending on memory layout and how the read is handled. The flaw does not imply remote code execution or data modification by itself.

Why it matters to the business

Because this issue is in the Linux kernel networking path, affected systems can include servers, appliances, containers hosts, routers, firewalls, and embedded Linux devices. A remote attacker may be able to disrupt availability by sending malformed network traffic to systems that process TCP or DCCP options through vulnerable netfilter/x_tables rules. For internet-facing Linux systems or infrastructure that relies on Linux-based packet filtering, the operational impact can be service interruption, node reboot, degraded network security controls, or cascading application outages. The issue is not currently listed in CISA KEV, has no known ransomware association, and has a low EPSS score, so urgency should be driven by exposure of affected packet-filtering paths and criticality of the systems rather than confirmed widespread exploitation.

How an attack unfolds

An attacker first identifies a Linux system, gateway, firewall, or appliance running a vulnerable kernel and reachable over the network. The attacker then sends specially crafted TCP or DCCP packets whose options section ends with a single trailing byte that is interpreted as a multi-byte option kind but has no following length byte. If the packet traverses netfilter rules that invoke the vulnerable TCP or DCCP option walkers, the kernel attempts to read one byte beyond the end of the option area. Depending on memory placement and kernel hardening, this may be harmless, trigger a kernel warning, cause an oops or panic, or disclose a very small amount of adjacent memory through matching behavior. Practical exploitation is most useful for denial of service against hosts or network security devices that inspect such traffic. There is no public indication from the provided data that mature exploit code or active threat actor exploitation exists.

How to fix it

Upgrade to a Linux kernel version from the relevant distribution or vendor that includes the upstream fix for netfilter x_tables option walkers guarding against one-byte tail reads in xt_tcpudp and xt_dccp. No exact fixed package versions were provided, so use vendor advisories for the specific distribution, appliance, or kernel branch and confirm the patch containing the explicit last-byte check before reading op[i + 1] is present. Where immediate patching is not possible, reduce exposure by removing or avoiding netfilter/x_tables rules that inspect TCP or DCCP options, disabling unused DCCP support where feasible, restricting untrusted traffic to systems performing packet inspection, and placing vulnerable systems behind patched filtering infrastructure. Kernel live patching may be acceptable if the vendor provides a live patch for this issue, but a reboot into the fixed kernel is the most reliable remediation.

How to confirm the fix worked

Confirm the running kernel package is at or above the vendor-fixed version once advisories are available, not just that an updated package is installed on disk. Validate with uname -a, distribution package metadata, and vendor security advisory references. If building from source, verify the netfilter xt_tcpudp and xt_dccp option walkers include a guard that checks for the final byte of the option area before dereferencing op[i + 1]. Review active firewall rules for TCP or DCCP option matching and confirm any risky rules were removed or the kernel was patched before re-enabling them. For high-assurance validation, use a non-production test system to send malformed TCP/DCCP option packets and confirm the patched kernel does not log warnings, oops, panics, or abnormal packet-filter behavior.

Typical attack path

1. Scan or select Linux systems, gateways, firewalls, load balancers, or appliances that may run vulnerable kernel versions and expose TCP or DCCP traffic paths.
2. Determine or assume that netfilter/x_tables rules are inspecting TCP or DCCP packet options using affected match extensions.
3. Craft malformed TCP packets with an options area whose final byte is a non-single-byte option kind without a following length byte, or analogous malformed DCCP option data.
4. Send the crafted traffic to or through the target system so it is processed by the vulnerable netfilter hook.
5. Trigger the vulnerable option walker to dereference one byte past the option buffer.
6. Cause kernel instability, crash, reboot, packet-filter failure, or limited information exposure depending on system behavior.

How to detect it

To determine whether exploitation was already attempted, review kernel logs, system journals, crash dumps, and network telemetry around unexplained reboots, kernel oops events, or packet-filter failures. Useful log sources include journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, dmesg output, kdump/vmcore records, hypervisor reset events, firewall logs, IDS/IPS alerts, and packet captures from perimeter or host sensors. Look for stack traces or warnings referencing netfilter, x_tables, xt_tcpudp, xt_dccp, tcp_find_option, or dccp_find_option shortly before a crash or reboot. On the network side, search for malformed TCP packets whose option area terminates with a single non-EOL/non-NOP option kind byte without the required length byte, and malformed DCCP packets with a dangling multi-byte option kind. Because a successful denial-of-service attempt may leave only a kernel crash and no application logs, correlate system reboot times with inbound malformed packet bursts. Absence of logs does not rule out exploitation if the host panicked before logs were flushed.

• xt_tcpudp
• xt_dccp
• tcp_find_option
• dccp_find_option
• x_tables
• netfilter: x_tables
• BUG: unable to handle kernel paging request
• BUG: kernel NULL pointer dereference
• kernel panic
• Oops:
• IP protocol 33
• DCCP
• TCP option area ending with trailing option kind >= 0x02 and no following length byte
• Malformed TCP options with dangling non-EOL/non-NOP final byte
• Malformed DCCP options with dangling multi-byte final option

What your security team should do

• Prioritize patching internet-facing Linux systems, Linux-based firewalls, routers, load balancers, Kubernetes/container hosts, and appliances that process untrusted network traffic through netfilter.
• Inventory systems using iptables, ip6tables, nftables compatibility layers, or x_tables modules that may load xt_tcpudp or xt_dccp.
• Check whether DCCP is needed; if not, disable or block DCCP traffic and prevent unnecessary DCCP-related modules from loading where supported.
• Temporarily remove or simplify firewall rules that inspect TCP or DCCP options on unpatched systems, especially on perimeter devices.
• Monitor kernel logs for crashes, oops traces, or warnings involving xt_tcpudp, xt_dccp, tcp_find_option, dccp_find_option, x_tables, or netfilter after malformed network traffic.
• Add network detections for malformed TCP options ending in a dangling multi-byte option kind and for malformed DCCP option areas where DCCP is not expected.
• Treat unexplained kernel panics on packet-filtering systems as potentially security-relevant until logs and traffic captures are reviewed.
• Track vendor kernel advisories because fixed versions vary by distribution and downstream appliance vendor.