CVE-2026-46244

Summary

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: Fix IPv6 inner_thoff desync

In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2.

For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux3a07327d10a09379315c844c63f27941f5081e0a < c161ad9157f5a0429b5ff94d9770faf3bf48d273affected
LinuxLinux3a07327d10a09379315c844c63f27941f5081e0a < 870d59e2cf218e7418491e26bad768cb16654582affected
LinuxLinux3a07327d10a09379315c844c63f27941f5081e0a < 689bbf48c1f45130086ae1c46ab83ea4c753c601affected
LinuxLinux3a07327d10a09379315c844c63f27941f5081e0a < d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ceaffected
LinuxLinux3a07327d10a09379315c844c63f27941f5081e0a < b6a91f68ebfed9c38e0e9150f58a9b85da07181caffected
LinuxLinux6.2affected
LinuxLinux0 < 6.2unaffected
LinuxLinux6.6.142 <= 6.6.*unaffected
LinuxLinux6.12.92 <= 6.12.*unaffected
LinuxLinux6.18.34 <= 6.18.*unaffected
LinuxLinux7.0.11 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

ADP Enrichment

kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync

Additional References

References