CVE-2026-52999
published 2026-06-24CVE-2026-52999: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the…
PriorityP350critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.52%
41.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once
and passed by reference to nf_osf_match_one() for each fingerprint
checked. During TCP option parsing, nf_osf_match_one() advances the
shared ctx->optp pointer.
If a fingerprint perfectly matches, the function returns early without
restoring ctx->optp to its initial state. If the user has configured
NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.
However, because ctx->optp was not restored, the next call to
nf_osf_match_one() starts parsing from the end of the options buffer.
This causes subsequent matches to read garbage data and fail
immediately, making it impossible to log more than one match or logging
incorrect matches.
Instead of using a shared ctx->optp pointer, pass the context as a
constant pointer and use a local pointer (optp) for TCP option
traversal. This makes nf_osf_match_one() strictly stateless from the
caller's perspective, ensuring every fingerprint check starts at the
correct option offset.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < 0145548346c4a30981a870a8ca00eac46ba27e85 | 0145548346c4a30981a870a8ca00eac46ba27e85 |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < 1c136f2c44a5913646bac85303612fd0825197a0 | 1c136f2c44a5913646bac85303612fd0825197a0 |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < 1e19a07291bb8682c14c39a64725a3ae54ab8ccc | 1e19a07291bb8682c14c39a64725a3ae54ab8ccc |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < 32e50f92c7cf3f4eba29622179a5fcdc2aebab41 | 32e50f92c7cf3f4eba29622179a5fcdc2aebab41 |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < 70a3f31d25cf2ec9d4ddfa408120171ead955623 | 70a3f31d25cf2ec9d4ddfa408120171ead955623 |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < 21883587593d7c8bb519a79460a0b5bc5ffbdabd | 21883587593d7c8bb519a79460a0b5bc5ffbdabd |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < edb78a142d2e5948e63647c0646aa7e7886935f0 | edb78a142d2e5948e63647c0646aa7e7886935f0 |
| linux | linux | >= 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b < f5ca450087c3baf3651055e7a6de92600f827af3 | f5ca450087c3baf3651055e7a6de92600f827af3 |
| linux | linux | >= 4.19.26 < 4.20 | 4.20 |
| linux | linux | >= 4.20.13 < 4.21 | 4.21 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.19.26 < 4.20 | 4.20 |
| linux | linux_kernel | >= 4.20.13 < 5.0 | 5.0 |
| linux | linux_kernel | >= 5.0.1 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.33 | 6.18.33 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
ghsa8.7HIGH
vendor_oracle7.5HIGH
vendor_ubuntu7.0HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46108 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD D
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TC
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46113 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD Distrib
Red Hat
kernel: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
vendor_redhat·2026-06-24·CVSS 5.5
CVE-2026-52999 [MEDIUM] CWE-125 kernel: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
kernel: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
A flaw was found in the Linux kernel's netfilter subsystem, specifically in the `nfnetlink_osf` module. When the `NF_OSF_LOGLEVEL_ALL` option is configured, an out-of-bounds read vulnerability can occur during TCP option parsing. This issue can lead to incorrect data processing and logging failures, potentially causing a denial of service by hindering the system's ability to accurately filter and monitor network traffic.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - No
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (jackson-core) — CVE-2025-52999
vendor_oracle·2026-01-15·CVSS 7.5
CVE-2025-52999 [HIGH] Oracle Oracle Analytics Risk Matrix: Analytics Server (jackson-core) — CVE-2025-52999
Oracle Oracle Analytics Risk Matrix: Analytics Server (jackson-core) vulnerability
CVE: CVE-2025-52999
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
GHSA
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized
ghsa_unreviewed·2026-06-24
CVE-2026-52999 In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once
and passed by reference to nf_osf_match_one() for each fingerprint
checked. During TCP option parsing, nf_osf_match_one() advances the
shared ctx->optp pointer.
If a fingerprint perfectly matches, the function returns early without
restoring ctx->optp to its initial state. If the user has configured
NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.
However, because ctx->optp was not restored, the next call to
nf_osf_match_one() starts parsing from the end of the options buffer.
This causes subsequent matches to read garbage data and fail
immediately, making it impossible
VulDB
Linux Kernel up to 7.0.9 netfilter nf_osf_match optp out-of-bounds
vuldb·2026-06-24
CVE-2026-52999 [LOW] Linux Kernel up to 7.0.9 netfilter nf_osf_match optp out-of-bounds
A vulnerability was found in Linux Kernel up to 7.0.9. It has been classified as critical. Affected by this vulnerability is the function nf_osf_match of the component netfilter. This manipulation of the argument optp causes out-of-bounds read.
This vulnerability appears as CVE-2026-52999. The attack requires local access. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
ghsa·2026-03-04·CVSS 8.7
CVE-2026-29062 [HIGH] CWE-770 jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
### Summary
The `UTF8DataInputJsonParser`, which is used when parsing from a `java.io.DataInput` source, bypasses the `maxNestingDepth` constraint (default: 500) defined in `StreamReadConstraints`.
A similar issue was found in `ReaderBasedJsonParser`.
This allows a user to supply a JSON document with excessive nesting, which can cause a `StackOverflowError` when the structure is processed, leading to a Denial of Service (DoS).
The related fix for com.fasterxml.jackson.core:jackson-core, CVE-2025-52999, was not fully applied to tools.jackson.core:jackson-core until the 3.1.0 release. It is recommended that 3.0.x users upgrade.
### Patches
jackson-core contains a config
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-52999 kernel: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
bugzilla·2026-06-24
CVE-2026-52999 [MEDIUM] CVE-2026-52999 kernel: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
CVE-2026-52999 kernel: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once
and passed by reference to nf_osf_match_one() for each fingerprint
checked. During TCP option parsing, nf_osf_match_one() advances the
shared ctx->optp pointer.
If a fingerprint perfectly matches, the function returns early without
restoring ctx->optp to its initial state. If the user has configured
NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.
However, because ctx->optp was not restored, the next call to
nf_osf_match_one() starts parsing from the end of the options buffer.
Thi
Bugzilla
CVE-2025-52999 resteasy: jackson-core Potential StackoverflowError [fedora-42]
bugzilla·2025-06-25·CVSS 8.7
CVE-2025-52999 [HIGH] CVE-2025-52999 resteasy: jackson-core Potential StackoverflowError [fedora-42]
CVE-2025-52999 resteasy: jackson-core Potential StackoverflowError [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2374804
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package M
Bugzilla
CVE-2025-52999 jackson-bom: jackson-core Potential StackoverflowError [fedora-42]
bugzilla·2025-06-25·CVSS 8.7
CVE-2025-52999 [HIGH] CVE-2025-52999 jackson-bom: jackson-core Potential StackoverflowError [fedora-42]
CVE-2025-52999 jackson-bom: jackson-core Potential StackoverflowError [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2374804
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Packag
Bugzilla
CVE-2025-52999 ceph: jackson-core Potential StackoverflowError [fedora-42]
bugzilla·2025-06-25·CVSS 8.7
CVE-2025-52999 [HIGH] CVE-2025-52999 ceph: jackson-core Potential StackoverflowError [fedora-42]
CVE-2025-52999 ceph: jackson-core Potential StackoverflowError [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2374804
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maint
Bugzilla
CVE-2025-52999 jackson-modules-base: jackson-core Potential StackoverflowError [fedora-42]
bugzilla·2025-06-25·CVSS 8.7
CVE-2025-52999 [HIGH] CVE-2025-52999 jackson-modules-base: jackson-core Potential StackoverflowError [fedora-42]
CVE-2025-52999 jackson-modules-base: jackson-core Potential StackoverflowError [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2374804
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'
Bugzilla
CVE-2025-52999 jackson-jaxrs-providers: jackson-core Potential StackoverflowError [fedora-42]
bugzilla·2025-06-25·CVSS 8.7
CVE-2025-52999 [HIGH] CVE-2025-52999 jackson-jaxrs-providers: jackson-core Potential StackoverflowError [fedora-42]
CVE-2025-52999 jackson-jaxrs-providers: jackson-core Potential StackoverflowError [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2374804
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '
Bugzilla
CVE-2025-52999 jackson-databind: jackson-core Potential StackoverflowError [fedora-42]
bugzilla·2025-06-25·CVSS 8.7
CVE-2025-52999 [HIGH] CVE-2025-52999 jackson-databind: jackson-core Potential StackoverflowError [fedora-42]
CVE-2025-52999 jackson-databind: jackson-core Potential StackoverflowError [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2374804
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
P
https://git.kernel.org/stable/c/0145548346c4a30981a870a8ca00eac46ba27e85https://git.kernel.org/stable/c/1c136f2c44a5913646bac85303612fd0825197a0https://git.kernel.org/stable/c/1e19a07291bb8682c14c39a64725a3ae54ab8ccchttps://git.kernel.org/stable/c/21883587593d7c8bb519a79460a0b5bc5ffbdabdhttps://git.kernel.org/stable/c/32e50f92c7cf3f4eba29622179a5fcdc2aebab41https://git.kernel.org/stable/c/70a3f31d25cf2ec9d4ddfa408120171ead955623https://git.kernel.org/stable/c/edb78a142d2e5948e63647c0646aa7e7886935f0https://git.kernel.org/stable/c/f5ca450087c3baf3651055e7a6de92600f827af3
2026-06-24
Published