CVE-2026-23397

Description

In the Linux kernel's nfnetlink_osf module, the function nfnl_osf_add_callback() validates the number of options (opt_num) and ensures NUL-termination of strings, but fails to check the length field of each individual TCP option within a fingerprint. This allows a crafted fingerprint containing a zero-length option to be added. During packet matching, nf_osf_match_one() enters the option matching loop even when the total option size (foptsize) is zero, leading to a NULL pointer dereference when ctx->optp is NULL, causing a kernel crash. Additionally, an MSS option (kind=2) with length less than 4 triggers an out-of-bounds read when accessing optp[2] and optp[3] for MSS value extraction.

Exploitation

Exploitation requires the ability to send netlink messages to add fingerprints, typically requiring CAP_NET_ADMIN privileges within a user namespace. The attacker uploads a crafted fingerprint with zero-length options or an MSS option with insufficient length. When a network packet matches this fingerprint (e.g., via iptables rules using the osf match), the kernel accesses invalid memory, leading to a general protection fault and potential system crash.

Impact

An attacker with sufficient privileges can trigger a denial-of-service (kernel panic) or potentially leak sensitive kernel memory due to out-of-bounds reads. The vulnerability can be exploited remotely if the attacker can influence packet matching, but local access to netlink is typically required.

Mitigation

The fix validates individual option lengths at fingerprint addition time, rejecting zero-length options and MSS options with length less than 4. The patches have been applied to stable kernel trees as tracked in commits [1], [2], [3], and [4]. Users should update their kernels to include these patches.