VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 3, 2026

CVE-2026-46244

CVE-2026-46244

Description

Linux kernel netfilter vulnerability allows transport header forgery and firewall bypass by desynchronizing IPv6 header offsets.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel netfilter vulnerability allows transport header forgery and firewall bypass by desynchronizing IPv6 header offsets.

Vulnerability

In the Linux kernel's netfilter subsystem, specifically within the nft_inner_parse_l2l3() function, a desynchronization occurs when processing inner IPv6 packets. The ipv6_find_hdr() function correctly calculates the transport header offset, but this result is immediately overwritten with an incorrect value based only on the IPv6 base header size. This affects stable versions from Linux 6.2.

Exploitation

An attacker can exploit this vulnerability by crafting specially malformed IPv6 packets that contain inner IPv6 packets with extension headers. By sending these packets through a system running an affected Linux kernel version, the desynchronization between the calculated transport header offset and the actual layer 4 protocol can be triggered, enabling the forgery.

Impact

Successful exploitation allows an attacker to perform transport header forgery, which can lead to potential firewall bypass. This means that network traffic that should be inspected or blocked by firewall rules might be misrepresented, allowing malicious or unintended traffic to pass through.

Mitigation

This vulnerability has been resolved by removing the incorrect overwrite in the nft_inner_parse_l2l3() function, ensuring that the correct transport header offset calculated by ipv6_find_hdr() is preserved. Users should update to a patched version of the Linux kernel. The specific fixed version is referenced in [1].

References
  1. Making sure you're not a bot!

AI Insight generated on Jun 3, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

10
b6a91f68ebfe

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitYizhou ZhaoMay 11, 2026Fixed in 7.1-rc5via kernel-cna
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index 03ffb1159fc18..859aa38e333b8 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
c161ad9157f5

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitYizhou ZhaoMay 11, 2026Fixed in 6.6.142via kernel-cna
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index 817ab978d24a1..5e6a1d3702b1b 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -156,7 +156,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
870d59e2cf21

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitYizhou ZhaoMay 11, 2026Fixed in 6.12.92via kernel-cna
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index 817ab978d24a1..5e6a1d3702b1b 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -156,7 +156,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
689bbf48c1f4

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitYizhou ZhaoMay 11, 2026Fixed in 6.18.34via kernel-cna
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index c4569d4b92285..1b3e7a976f560 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
d0f98a3617f6

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitYizhou ZhaoMay 11, 2026Fixed in 7.0.11via kernel-cna
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index c4569d4b92285..1b3e7a976f560 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
689bbf48c1f4

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitYizhou ZhaoMay 11, 2026via nvd-ref
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index c4569d4b92285..1b3e7a976f560 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
870d59e2cf21

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitYizhou ZhaoMay 11, 2026via nvd-ref
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index 817ab978d24a1..5e6a1d3702b1b 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -156,7 +156,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
b6a91f68ebfe

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitYizhou ZhaoMay 11, 2026via nvd-ref
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index 03ffb1159fc18..859aa38e333b8 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
c161ad9157f5

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitYizhou ZhaoMay 11, 2026via nvd-ref
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index 817ab978d24a1..5e6a1d3702b1b 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -156,7 +156,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg
d0f98a3617f6

netfilter: nft_inner: Fix IPv6 inner_thoff desync

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitYizhou ZhaoMay 11, 2026via nvd-ref
commit
1 file changed · +0 −2
  • net/netfilter/nft_inner.c+0 −2 modified
    diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index c4569d4b92285..1b3e7a976f560 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv,
 			return -1;
 
 		if (fragoff == 0) {
-			thoff = nhoff + sizeof(_ip6h);
 			ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 			ctx->inner_thoff = thoff;
 			ctx->l4proto = l4proto;
-- 
cgit 1.3-korg

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

5

News mentions

0

No linked articles in our index yet.