CVE-2026-52998
published 2026-06-24CVE-2026-52998: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl()…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.51%
40.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
The nf_osf_ttl() function accessed skb->dev to perform a local interface
address lookup without verifying that the device pointer was valid.
Additionally, the implementation utilized an in_dev_for_each_ifa_rcu
loop to match the packet source address against local interface
addresses. It assumed that packets from the same subnet should not see a
decrement on the initial TTL. A packet might appear it is from the same
subnet but it actually isn't especially in modern environments with
containers and virtual switching.
Remove the device dereference and interface loop. Replace the logic with
a switch statement that evaluates the TTL according to the ttl_check.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < f4de0777e4554a7de19c920accde6319dd530782 | f4de0777e4554a7de19c920accde6319dd530782 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < c996a90f3071cf43683e5423da31aadbe002b8b4 | c996a90f3071cf43683e5423da31aadbe002b8b4 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < edc806f9122961f0d3819f7c69c14cccde31f277 | edc806f9122961f0d3819f7c69c14cccde31f277 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 5d05de2f0928d81309a815ecc76d1a3ad72cbc16 | 5d05de2f0928d81309a815ecc76d1a3ad72cbc16 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 95be653a76793856ff8b2d8bd82c2943c23f5ca8 | 95be653a76793856ff8b2d8bd82c2943c23f5ca8 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 79b90a96688e521771fa6ed3dc7864b76b8df293 | 79b90a96688e521771fa6ed3dc7864b76b8df293 |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 83fc5dd63455a779ea2dd0f7ffee3c920919d80b | 83fc5dd63455a779ea2dd0f7ffee3c920919d80b |
| linux | linux | >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 711987ba281fd806322a7cd244e98e2a81903114 | 711987ba281fd806322a7cd244e98e2a81903114 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.31 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19 < 7.0.10 | 7.0.10 |
| linux | linux_kernel | >= 6.2 < 6.6.141 | 6.6.141 |
| linux | linux_kernel | >= 6.7 < 6.12.91 | 6.12.91 |
| ubuntu | linux | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-6.8 | — | — |
| ubuntu | linux-gke | — | — |
| ubuntu | linux-gkeop | — | — |
| ubuntu | linux-hwe-7.0 | — | — |
| ubuntu | linux-oem-7.0 | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.0MEDIUM
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.9 netfilter nf_osf_ttl dev infinite loop
vuldb·2026-06-24
CVE-2026-52998 [CRITICAL] Linux Kernel up to 7.0.9 netfilter nf_osf_ttl dev infinite loop
A vulnerability identified as critical has been detected in Linux Kernel up to 7.0.9. Affected by this issue is the function nf_osf_ttl of the component netfilter. Performing a manipulation of the argument dev results in infinite loop.
This vulnerability was named CVE-2026-52998. The attack needs to be approached locally. There is no available exploit.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl() function accessed skb->dev to perform a loc
ghsa_unreviewed·2026-06-24
CVE-2026-52998 In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl() function accessed skb->dev to perform a loc
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
The nf_osf_ttl() function accessed skb->dev to perform a local interface
address lookup without verifying that the device pointer was valid.
Additionally, the implementation utilized an in_dev_for_each_ifa_rcu
loop to match the packet source address against local interface
addresses. It assumed that packets from the same subnet should not see a
decrement on the initial TTL. A packet might appear it is from the same
subnet but it actually isn't especially in modern environments with
containers and virtual switching.
Remove the device dereference and interface loop. Replace the logic with
a switch statement that evaluates the TTL according to the ttl_c
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46108 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD D
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TC
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46113 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD Distrib
Red Hat
kernel: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-52998 [MEDIUM] CWE-476 kernel: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
kernel: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
A flaw was found in the Linux kernel's Netfilter subsystem, specifically within the nfnetlink_osf module. The nf_osf_ttl() function could attempt to access a device pointer that was not properly validated, leading to a potential null pointer dereference. This vulnerability could allow a local attacker to trigger a system crash, resulting in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/5d05de2f0928d81309a815ecc76d1a3ad72cbc16https://git.kernel.org/stable/c/711987ba281fd806322a7cd244e98e2a81903114https://git.kernel.org/stable/c/79b90a96688e521771fa6ed3dc7864b76b8df293https://git.kernel.org/stable/c/83fc5dd63455a779ea2dd0f7ffee3c920919d80bhttps://git.kernel.org/stable/c/95be653a76793856ff8b2d8bd82c2943c23f5ca8https://git.kernel.org/stable/c/c996a90f3071cf43683e5423da31aadbe002b8b4https://git.kernel.org/stable/c/edc806f9122961f0d3819f7c69c14cccde31f277https://git.kernel.org/stable/c/f4de0777e4554a7de19c920accde6319dd530782
2026-06-24
Published