CVE-2026-52999

What it actually does

This flaw is an out-of-bounds read in the Linux kernel netfilter OS fingerprinting path, specifically nfnetlink_osf option matching. When passive TCP OS fingerprinting is configured to log all matching fingerprints, a TCP option parsing pointer can be advanced during one fingerprint comparison and then reused for the next comparison without being reset. Subsequent fingerprint checks may therefore parse from the wrong offset, read data beyond the intended TCP options buffer, and produce incorrect or incomplete OS fingerprint logs. The impact is primarily information disclosure and integrity loss in security logging rather than code execution.

Why it matters to the business

Systems using Linux netfilter OS fingerprinting for traffic classification, firewall policy decisions, monitoring, or forensic logging may record inaccurate results or fail to log expected matches. This can reduce confidence in network telemetry and incident investigations. The currently observed exploitation likelihood is low: EPSS is 0.00514, there is no known CISA KEV listing, no ransomware association, and no public exploit maturity reported.

How an attack unfolds

An attacker must be able to send TCP traffic to or through a Linux system that has netfilter OS fingerprint matching enabled, particularly with logging configured to evaluate all matches. The attacker crafts TCP packets whose options cause one fingerprint comparison to match cleanly. Because the kernel parser advances an internal option pointer and returns early without restoring it, the next fingerprint comparison begins from the wrong location. That later comparison can read unintended data past the valid TCP option parsing region, resulting in incorrect fingerprint results or failed logging. In realistic scenarios, exploitation is most relevant against firewalls, routers, gateways, or monitored Linux hosts that explicitly use netfilter OS fingerprinting; systems not using this feature are unlikely to be exposed.

How to fix it

Apply a Linux kernel update that includes the fix for nfnetlink_osf option matching, where TCP option traversal uses a local pointer per fingerprint check instead of mutating shared parser state. If vendor packages are used, install the latest kernel updates from the Linux distribution or appliance vendor. Where immediate patching is not possible, reduce exposure by disabling unused netfilter OS fingerprinting rules, avoiding configurations that log all OS fingerprint matches, and removing or unloading related OS fingerprinting functionality if it is not required. Reboot into the patched kernel after installation and confirm the running kernel version changed, since installing a kernel package alone does not remediate systems still booted into the vulnerable kernel.

How to confirm the fix worked

Confirm remediation by verifying the running kernel is a vendor-fixed build and not merely that an updated package is installed. Review firewall rules for use of OS fingerprint matching, such as iptables/nftables rules that invoke the OSF match extension. Validate that the system no longer uses vulnerable kernel code by checking the active kernel version after reboot. If source-level validation is possible, confirm the nf_osf_match_one logic no longer mutates shared context state for TCP option traversal and instead uses a local option pointer for each fingerprint evaluation. Functional validation can include testing OS fingerprint logging with multiple expected matches and confirming logs remain consistent across repeated TCP packets.

Typical attack path

1. Identify or assume a Linux host, firewall, router, or gateway is using netfilter OS fingerprint matching.
2. Send TCP packets with crafted TCP option layouts toward or through the target system.
3. Trigger a fingerprint match while OS fingerprint logging is configured to evaluate all matches.
4. Cause subsequent fingerprint evaluations to reuse an already-advanced option pointer.
5. Induce incorrect OS fingerprint logs, missed matches, or limited out-of-bounds reads during TCP option parsing.

How to detect it

There are no reliable public indicators that uniquely prove exploitation of this issue. Detection should focus on exposure and suspicious triggering conditions. Review firewall configurations for use of netfilter OS fingerprint matching and log-all behavior. Check kernel and firewall logs for bursts of unusual TCP option traffic, inconsistent OS fingerprint results for the same source, repeated failed or missing OS fingerprint matches, or unexpected changes in passive OS fingerprint logging volume. Relevant log sources include kernel logs, syslog or journald, firewall audit logs, iptables/nftables rule change logs, network IDS telemetry, and packet captures from perimeter systems. For forensics, examine whether OSF-related modules were loaded and whether administrative changes enabled OS fingerprint matching before suspicious traffic occurred. Because this is a kernel parsing flaw with no known exploit maturity and no KEV listing, absence of a crash or explicit error message does not conclusively rule out triggering.

What your security team should do

• Prioritize patching Linux firewalls, routers, gateways, monitoring sensors, and internet-facing systems that use netfilter OS fingerprinting.
• Inventory systems for OS fingerprint matching rules or loaded netfilter OSF-related modules before assigning broad risk to all Linux hosts.
• If patching must be delayed, disable unnecessary OS fingerprint logging or avoid log-all configurations for OSF matching.
• Confirm all patched systems have rebooted into the updated kernel.
• Monitor kernel, firewall, and netfilter logs for anomalous OS fingerprinting behavior, repeated malformed TCP option traffic, or sudden loss of expected OS fingerprint logs.
• Track vendor advisories for the specific Linux distribution or appliance, because fixed kernel package names and versions vary by vendor.