CVE-2026-45841

What it actually does

This flaw is a local denial-of-service vulnerability in the Linux kernel netfilter OS fingerprinting path. A user or process with CAP_NET_ADMIN can submit a malformed nfnetlink_osf fingerprint where the window-size modulo value is zero. When a TCP SYN packet is later evaluated by the OSF match logic, the kernel performs a modulo operation using that zero value, triggering a divide-by-zero exception and kernel panic. The impact is availability loss only; the issue is not described as enabling data disclosure, privilege escalation, or code execution.

Why it matters to the business

Systems that allow delegated network administration privileges, containers or services with CAP_NET_ADMIN, or untrusted local administrators can be crashed on demand, causing service interruption, workload restarts, failover events, and potential data-processing disruption. Internet-facing exposure alone is not sufficient unless an attacker can first gain the required local network administration capability, but multi-tenant, containerized, lab, hosting, and network-appliance environments are higher risk. The CVE is not currently listed in CISA KEV, is not marked as ransomware-associated, and has low EPSS, so broad exploitation pressure appears limited; however, the crash condition is straightforward once the prerequisite privilege is available.

How an attack unfolds

An attacker first obtains local access to a Linux system or compromises a process/container that has CAP_NET_ADMIN. They then use the nfnetlink OS fingerprinting interface to add a crafted OS fingerprint with an invalid window-size setting, specifically a modulo match with a zero divisor or otherwise invalid OSF WSS class. If packet filtering rules are configured to evaluate TCP SYN packets with the OSF matcher, or the attacker can arrange for such a rule, the attacker sends or causes a matching TCP SYN packet to traverse the netfilter hook. During packet evaluation, nf_osf_match_one() computes the TCP window value modulo the attacker-controlled zero value. The CPU raises a divide error in interrupt/softirq packet-processing context, producing an Oops and typically panicking the kernel, which immediately disrupts all workloads on the host until it reboots or is manually recovered.

How to fix it

Upgrade the Linux kernel to a vendor release that includes the nfnetlink_osf fix rejecting invalid OSF WSS values before fingerprints are accepted. No exact fixed package versions were provided in the input, so use the relevant distribution or kernel vendor advisory for the precise patched kernel version. As mitigations until patching is complete, avoid granting CAP_NET_ADMIN to untrusted users, services, or containers; remove unnecessary CAP_NET_ADMIN from container profiles; restrict access to network namespace administration; avoid use of the netfilter OSF matcher where not required; remove untrusted OSF fingerprints; and limit who can modify iptables/nftables/netfilter state. Reboot into the patched kernel after installation, because kernel package installation alone does not protect a running unpatched kernel.

How to confirm the fix worked

Confirm the running kernel, not only the installed package, is patched according to the distribution advisory. Validate that untrusted workloads do not retain CAP_NET_ADMIN by reviewing service unit capabilities, container runtime security contexts, and namespace delegation policies. Check active firewall rules for use of the OSF matcher and confirm it is necessary. If safe in a controlled test environment, attempt to add a malformed OSF fingerprint with zero modulo WSS; a patched kernel should reject the fingerprint rather than accepting it and later crashing. Also verify that recent crash logs no longer show divide errors in nf_osf_match_one or call traces through xt_osf_match_packet.

Typical attack path

1. Gain local execution on the target system or control over a process/container with CAP_NET_ADMIN.
2. Access the nfnetlink_osf interface used to manage netfilter OS fingerprint entries.
3. Add a malformed OS fingerprint using the OSF_WSS_MODULO mode with a zero window-size modulo value, or an invalid WSS class rejected by patched kernels.
4. Ensure a netfilter rule path uses the OSF matcher against TCP SYN packets.
5. Send or trigger a TCP SYN packet that reaches the affected OSF match path.
6. Kernel packet-processing code executes the unchecked modulo operation and triggers a divide-by-zero exception.
7. The system crashes or panics, causing denial of service until reboot or recovery.

How to detect it

Look for evidence of host crashes, kernel Oops events, or panic/reboot sequences with a divide-by-zero fault in the netfilter OS fingerprinting path. Useful sources include kernel logs, systemd-journald, /var/log/kern.log, /var/log/messages, crash dump systems such as kdump/vmcore, hypervisor reset events, endpoint telemetry, and audit logs showing changes to firewall or netfilter configuration. Investigate activity by users, containers, or services with CAP_NET_ADMIN shortly before a crash, especially netlink/netfilter changes, iptables rules using the OSF match extension, or loading/use of xt_osf and nfnetlink_osf modules. A suspicious sequence is: modification of OSF fingerprints or OSF-based firewall rules, followed by inbound or locally generated TCP SYN traffic, followed by a kernel divide error call trace containing nf_osf_match_one. Because this is a denial-of-service bug, there may be no persistent malware artifact; the strongest evidence is the crash signature and preceding privileged netfilter manipulation.

• Oops: divide error: 0000
• RIP: 0010:nf_osf_match_one
• nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
• nf_osf_match (net/netfilter/nfnetlink_osf.c:220)
• xt_osf_match_packet (net/netfilter/xt_osf.c:32)
• ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
• nf_hook_slow (net/netfilter/core.c:622)
• ip_local_deliver (net/ipv4/ip_input.c:265)
• __netif_receive_skb_one_core
• process_backlog
• net_rx_action
• OSF_WSS_MODULO
• nfnetlink_osf
• xt_osf
• -m osf
• CAP_NET_ADMIN

What your security team should do

• Prioritize patching systems where untrusted users, containers, CI jobs, network appliances, or delegated administrators may have CAP_NET_ADMIN.
• Inventory Linux hosts using netfilter OS fingerprinting or xt_osf/nfnetlink_osf and treat those as higher exposure.
• Remove CAP_NET_ADMIN from containers and services unless it is strictly required; replace broad capabilities with narrower networking controls where possible.
• Review iptables/nftables/netfilter management permissions and ensure only trusted administrators can modify OSF fingerprints and packet-filter rules.
• Search historical kernel logs, crash dumps, and SIEM data for divide-by-zero crashes involving nf_osf_match_one, nf_osf_match, or xt_osf_match_packet.
• Ensure reboot coordination is included in patch plans so hosts actually run the fixed kernel.
• For high-availability services, verify failover behavior and crash-recovery monitoring because exploitation results in abrupt host-level outage.