CVE-2026-23397 — Improper Handling of Length Parameter Inconsistency in Linux
Severity
8.2HIGH
No vectorEPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 26
Latest updateApr 20
Description
In the Linux kernel, the following vulnerability has been resolved:
nfnetlink_osf: validate individual option lengths in fingerprints
nfnl_osf_add_callback() validates opt_num bounds and string
NUL-termination but does not check individual option length fields.
A zero-length option causes nf_osf_match_one() to enter the option
matching loop even when foptsize sums to zero, which matches packets
with no TCP options where ctx->optp is NULL:
Oops: general protection fault
KASAN: null-ptr-deref i…
Affected Packages5 packages
▶CVEListV5linux/linux11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 — aa0574182c46963c3cdb8cde46ec93aca21100d8+6
🔴Vulnerability Details
4VulDB▶
Linux Kernel up to 7.0-rc4 nfnetlink_osf nfnetlink_osf.c nfnl_osf_add_callback out-of-bounds (EUVD-2026-16157 / WID-SEC-2026-0879)↗2026-04-20
OSV▶
CVE-2026-23397: In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_cal↗2026-03-26
GHSA▶
GHSA-3rcm-5vqm-53w6: In the Linux kernel, the following vulnerability has been resolved:
nfnetlink_osf: validate individual option lengths in fingerprints
nfnl_osf_add_c↗2026-03-26