CVE-2026-45841
published 2026-05-27CVE-2026-45841: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO nf_osf_match_one() computes…
medium5.5
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
nf_osf_match_one() computes ctx->window % f->wss.val in the
OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A
CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a
subsequent matching TCP SYN divides by zero and panics the kernel.
Reject the bogus fingerprint in nfnl_osf_add_callback() above the
per-option for-loop. f->wss is per-fingerprint, not per-option, so
the check must run regardless of f->opt_num (including 0). Also
reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that
as "should not happen".
Crash:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
Call Trace:
nf_osf_match (net/netfilter/nfnetlink_osf.c:220)
xt_osf_match_packet (net/netfilter/xt_osf.c:32)
ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
nf_hook_slow (net/netfilter/core.c:622)
ip_local_deliver (net/ipv4/ip_input.c:265)
ip_rcv (include/linux/skbuff.h:1162)
__netif_receive_skb_one_core (net/core/dev.c:6181)
process_backlog (net/core/dev.c:6642)
__napi_poll (net/core/dev.c:7710)
net_rx_action (net/core/dev.c:7945)
handle_softirqs (kernel/softirq.c:622)
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < cb833bbc1b3c51e08652d3c86298307c07d3f2db | cb833bbc1b3c51e08652d3c86298307c07d3f2db |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 26900306a5a2c3e4f75c643a064525526bb6e5f3 | 26900306a5a2c3e4f75c643a064525526bb6e5f3 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 0694618cf3e9b120666e31f5f383a6e466d95a0d | 0694618cf3e9b120666e31f5f383a6e466d95a0d |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 8def8fbd23f40e945febe913d04b731012ce0082 | 8def8fbd23f40e945febe913d04b731012ce0082 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < c55940895245d8ef658ab381248a28755218d625 | c55940895245d8ef658ab381248a28755218d625 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f | fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 9a05e195618a6d474f2bcd5b6376d0ffc2f00366 | 9a05e195618a6d474f2bcd5b6376d0ffc2f00366 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 2195574dc6d9017d32ac346987e12659f931d932 | 2195574dc6d9017d32ac346987e12659f931d932 |
| linux | linux_kernel | — | — |