Critical severity9.1NVD Advisory· Published Jun 3, 2026· Updated Aug 19, 2026
CVE-2026-46244
CVE-2026-46244
Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_inner: Fix IPv6 inner_thoff desync
In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2.
For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
96cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.2,<6.6.142
- cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*
- (no CPE)range: from Linux 6.2
- osv-coords90 versionspkg:linux/kernelpkg:rpm/almalinux/kernelpkg:rpm/almalinux/kernel-64kpkg:rpm/almalinux/kernel-64k-corepkg:rpm/almalinux/kernel-64k-debugpkg:rpm/almalinux/kernel-64k-debug-corepkg:rpm/almalinux/kernel-64k-debug-develpkg:rpm/almalinux/kernel-64k-debug-devel-matchedpkg:rpm/almalinux/kernel-64k-debug-modulespkg:rpm/almalinux/kernel-64k-debug-modules-corepkg:rpm/almalinux/kernel-64k-debug-modules-extrapkg:rpm/almalinux/kernel-64k-develpkg:rpm/almalinux/kernel-64k-devel-matchedpkg:rpm/almalinux/kernel-64k-modulespkg:rpm/almalinux/kernel-64k-modules-corepkg:rpm/almalinux/kernel-64k-modules-extrapkg:rpm/almalinux/kernel-abi-stablelistspkg:rpm/almalinux/kernel-corepkg:rpm/almalinux/kernel-cross-headerspkg:rpm/almalinux/kernel-debugpkg:rpm/almalinux/kernel-debug-corepkg:rpm/almalinux/kernel-debug-develpkg:rpm/almalinux/kernel-debug-devel-matchedpkg:rpm/almalinux/kernel-debug-modulespkg:rpm/almalinux/kernel-debug-modules-corepkg:rpm/almalinux/kernel-debug-modules-extrapkg:rpm/almalinux/kernel-debug-uki-virtpkg:rpm/almalinux/kernel-develpkg:rpm/almalinux/kernel-devel-matchedpkg:rpm/almalinux/kernel-docpkg:rpm/almalinux/kernel-headerspkg:rpm/almalinux/kernel-modulespkg:rpm/almalinux/kernel-modules-corepkg:rpm/almalinux/kernel-modules-extrapkg:rpm/almalinux/kernel-modules-extra-matchedpkg:rpm/almalinux/kernel-rtpkg:rpm/almalinux/kernel-rt-64kpkg:rpm/almalinux/kernel-rt-64k-corepkg:rpm/almalinux/kernel-rt-64k-debugpkg:rpm/almalinux/kernel-rt-64k-debug-corepkg:rpm/almalinux/kernel-rt-64k-debug-develpkg:rpm/almalinux/kernel-rt-64k-debug-modulespkg:rpm/almalinux/kernel-rt-64k-debug-modules-corepkg:rpm/almalinux/kernel-rt-64k-debug-modules-extrapkg:rpm/almalinux/kernel-rt-64k-develpkg:rpm/almalinux/kernel-rt-64k-modulespkg:rpm/almalinux/kernel-rt-64k-modules-corepkg:rpm/almalinux/kernel-rt-64k-modules-extrapkg:rpm/almalinux/kernel-rt-corepkg:rpm/almalinux/kernel-rt-debugpkg:rpm/almalinux/kernel-rt-debug-corepkg:rpm/almalinux/kernel-rt-debug-develpkg:rpm/almalinux/kernel-rt-debug-modulespkg:rpm/almalinux/kernel-rt-debug-modules-corepkg:rpm/almalinux/kernel-rt-debug-modules-extrapkg:rpm/almalinux/kernel-rt-develpkg:rpm/almalinux/kernel-rt-modulespkg:rpm/almalinux/kernel-rt-modules-corepkg:rpm/almalinux/kernel-rt-modules-extrapkg:rpm/almalinux/kernel-toolspkg:rpm/almalinux/kernel-tools-libspkg:rpm/almalinux/kernel-tools-libs-develpkg:rpm/almalinux/kernel-uki-virtpkg:rpm/almalinux/kernel-uki-virt-addonspkg:rpm/almalinux/kernel-zfcpdumppkg:rpm/almalinux/kernel-zfcpdump-corepkg:rpm/almalinux/kernel-zfcpdump-develpkg:rpm/almalinux/kernel-zfcpdump-devel-matchedpkg:rpm/almalinux/kernel-zfcpdump-modulespkg:rpm/almalinux/kernel-zfcpdump-modules-corepkg:rpm/almalinux/kernel-zfcpdump-modules-extrapkg:rpm/almalinux/libperfpkg:rpm/almalinux/perfpkg:rpm/almalinux/python3-perfpkg:rpm/almalinux/rtlapkg:rpm/almalinux/rvpkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2016.0
>= 6.2.0, < 6.6.142+ 89 more
- (no CPE)range: >= 6.2.0, < 6.6.142
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-211.30.1.el10_2
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1.160000.2.17
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 7.0.12-1.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
Patches
Vulnerability mechanics
References
16- git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601nvdPatch
- git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582nvdPatch
- git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181cnvdPatch
- git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273nvdPatch
- git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279cenvdPatch
- access.redhat.com/errata/RHSA-2026:33215nvd
- access.redhat.com/errata/RHSA-2026:34094nvd
- access.redhat.com/errata/RHSA-2026:34443nvd
- access.redhat.com/errata/RHSA-2026:34911nvd
- access.redhat.com/errata/RHSA-2026:36018nvd
- access.redhat.com/errata/RHSA-2026:55618nvd
- access.redhat.com/errata/RHSA-2026:55763nvd
- access.redhat.com/errata/RHSA-2026:56225nvd
- access.redhat.com/security/cve/CVE-2026-46244nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46244.jsonnvd
News mentions
0No linked articles in our index yet.