|
Vulnerabilities
< Back

CVE-2026-52999

Updated on 24 Jun 2026

Severity

9.1 Critical severity

Details

CVSS score
9.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each fingerprint checked. During TCP option parsing, nf_osf_match_one() advances the shared ctx->optp pointer.

If a fingerprint perfectly matches, the function returns early without restoring ctx->optp to its initial state. If the user has configured NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint. However, because ctx->optp was not restored, the next call to nf_osf_match_one() starts parsing from the end of the options buffer. This causes subsequent matches to read garbage data and fail immediately, making it impossible to log more than one match or logging incorrect matches.

Instead of using a shared ctx->optp pointer, pass the context as a constant pointer and use a local pointer (optp) for TCP option traversal. This makes nf_osf_match_one() strictly stateless from the caller’s perspective, ensuring every fingerprint check starts at the correct option offset.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
kernel @ 5.10.0 (+6 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Amazon Linux 2023 Planned —
Debian 11 Released
37 kernels
  • 5.10.46-5
  • 5.10.70-1
  • 5.10.46-4
  • 5.10.84-1
  • 5.10.92-1
  • 5.10.92-2
  • 5.10.103-1
  • 5.10.106-1
  • 5.10.113-1
  • 5.10.120-1
  • 5.10.127-1
  • 5.10.127-2
  • 5.10.136-1
  • 5.10.140-1
  • 5.10.149-1
  • 5.10.149-2
  • 5.10.158-2
  • 5.10.162-1
  • 5.10.179-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.178-3
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 11 cloud Released
17 kernels
  • 5.10.113-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 12 Planned —
Proxmox VE 7 5.15 Released
47 kernels
  • 5.15.5-1-pve-5.15.5-1
  • 5.15.12-1-pve-5.15.12-2
  • 5.15.12-1-pve-5.15.12-3
  • 5.15.17-1-pve-5.15.17-1
  • 5.15.19-1-pve-5.15.19-1
  • 5.15.19-2-pve-5.15.19-2
  • 5.15.19-2-pve-5.15.19-3
  • 5.15.27-1-pve-5.15.27-1
  • 5.15.30-1-pve-5.15.30-1
  • 5.15.30-2-pve-5.15.30-3
  • 5.15.35-1-pve-5.15.35-1
  • 5.15.35-1-pve-5.15.35-2
  • 5.15.35-1-pve-5.15.35-3
  • 5.15.35-2-pve-5.15.35-4
  • 5.15.35-2-pve-5.15.35-5
  • 5.15.35-3-pve-5.15.35-6
  • 5.15.39-1-pve-5.15.39-1
  • 5.15.39-2-pve-5.15.39-2
  • 5.15.39-3-pve-5.15.39-3
  • 5.15.39-4-pve-5.15.39-4
  • 5.15.7-1-pve-5.15.7-1
  • 5.15.53-1-pve-5.15.53-1
  • 5.15.60-1-pve-5.15.60-1
  • 5.15.60-2-pve-5.15.60-2
  • 5.15.64-1-pve-5.15.64-1
  • 5.15.74-1-pve-5.15.74-1
  • 5.15.83-1-pve-5.15.83-1
  • 5.15.102-1-pve-5.15.102-1
  • 5.15.104-1-pve-5.15.104-1
  • 5.15.104-1-pve-5.15.104-2
  • 5.15.107-1-pve-5.15.107-1
  • 5.15.107-2-pve-5.15.107-2
  • 5.15.85-1-pve-5.15.85-1
  • 5.15.108-1-pve-5.15.108-1
  • 5.15.108-1-pve-5.15.108-2
  • 5.15.116-1-pve-5.15.116-1
  • 5.15.126-1-pve-5.15.126-1
  • 5.15.131-1-pve-5.15.131-1
  • 5.15.131-1-pve-5.15.131-2
  • 5.15.131-2-pve-5.15.131-3
  • 5.15.136-1-pve-5.15.136-1
  • 5.15.111-1-pve-5.15.111-1
  • 5.15.143-1-pve-5.15.143-1
  • 5.15.149-1-pve-5.15.149-1
  • 5.15.152-1-pve-5.15.152-1
  • 5.15.158-1-pve_5.15.158-1
  • 5.15.158-2-pve_5.15.158-2
Ubuntu 20.04 Planned —
Ubuntu 20.04 HWE AWS Released
57 kernels
  • 5.15.0-1026.30~20.04.2
  • 5.15.0-1022.26~20.04.1
  • 5.15.0-1023.27~20.04.1
  • 5.15.0-1021.25~20.04.1
  • 5.15.0-1020.24~20.04.1
  • 5.15.0-1017.21~20.04.1
  • 5.15.0-1019.23~20.04.1
  • 5.15.0-1014.18~20.04.1
  • 5.15.0-1015.19~20.04.1
  • 5.15.0-1018.22~20.04.1
  • 5.15.0-1027.31~20.04.1
  • 5.15.0-1028.32~20.04.1
  • 5.15.0-1030.34~20.04.1
  • 5.15.0-1031.35~20.04.1
  • 5.15.0-1033.37~20.04.1
  • 5.15.0-1034.38~20.04.1
  • 5.15.0-1035.39~20.04.1
  • 5.15.0-1036.40~20.04.1
  • 5.15.0-1037.41~20.04.1
  • 5.15.0-1038.43~20.04.1
  • 5.15.0-1039.44~20.04.1
  • 5.15.0-1040.45~20.04.1
  • 5.15.0-1041.46~20.04.1
  • 5.15.0-1043.48~20.04.1
  • 5.15.0-1044.49~20.04.1
  • 5.15.0-1045.50~20.04.1
  • 5.15.0-1047.52~20.04.1
  • 5.15.0-1048.53~20.04.1
  • 5.15.0-1049.54~20.04.1
  • 5.15.0-1050.55~20.04.1
  • 5.15.0-1051.56~20.04.1
  • 5.15.0-1052.57~20.04.1
  • 5.15.0-1053.58~20.04.1
  • 5.15.0-1055.60~20.04.1
  • 5.15.0-1056.61~20.04.1
  • 5.15.0-1057.63~20.04.1
  • 5.15.0-1058.64~20.04.1
  • 5.15.0-1061.67~20.04.1
  • 5.15.0-1062.68~20.04.1
  • 5.15.0-1063.69~20.04.1
  • 5.15.0-1064.70~20.04.1
  • 5.15.0-1065.71~20.04.1
  • 5.15.0-1066.72~20.04.1
  • 5.15.0-1067.73~20.04.1
  • 5.15.0-1068.74~20.04.1
  • 5.15.0-1069.75~20.04.1
  • 5.15.0-1070.76~20.04.1
  • 5.15.0-1071.77~20.04.1
  • 5.15.0-1072.78~20.04.1
  • 5.15.0-1073.79~20.04.1
  • 5.15.0-1075.82~20.04.1
  • 5.15.0-1077.84~20.04.1
  • 5.15.0-1080.87~20.04.1
  • 5.15.0-1081.88~20.04.1
  • 5.15.0-1082.89~20.04.1
  • 5.15.0-1083.90~20.04.1
  • 5.15.0-1084.91~20.04.1
Ubuntu 20.04 HWE Azure Released
40 kernels
  • 5.15.0-1029.36~20.04.1
  • 5.15.0-1022.27~20.04.1
  • 5.15.0-1023.29~20.04.1
  • 5.15.0-1021.26~20.04.1
  • 5.15.0-1020.25~20.04.1
  • 5.15.0-1017.20~20.04.1
  • 5.15.0-1019.24~20.04.1
  • 5.15.0-1008.9~20.04.1
  • 5.15.0-1013.16~20.04.1
  • 5.15.0-1014.17~20.04.1
  • 5.15.0-1024.30~20.04.1
  • 5.15.0-1034.41~20.04.1
  • 5.15.0-1049.56~20.04.1
  • 5.15.0-1050.57~20.04.1
  • 5.15.0-1054.62~20.04.1
  • 5.15.0-1056.64~20.04.1
  • 5.15.0-1057.65~20.04.1
  • 5.15.0-1058.66~20.04.2
  • 5.15.0-1059.67~20.04.1
  • 5.15.0-1060.69~20.04.1
  • 5.15.0-1061.70~20.04.1
  • 5.15.0-1063.72~20.04.1
  • 5.15.0-1064.73~20.04.1
  • 5.15.0-1067.76~20.04.1
  • 5.15.0-1068.77~20.04.1
  • 5.15.0-1065.74~20.04.1
  • 5.15.0-1070.79~20.04.1
  • 5.15.0-1071.80~20.04.1
  • 5.15.0-1072.81~20.04.1
  • 5.15.0-1073.82~20.04.1
  • 5.15.0-1074.83~20.04.1
  • 5.15.0-1075.84~20.04.1
  • 5.15.0-1078.87~20.04.1
  • 5.15.0-1079.88~20.04.1
  • 5.15.0-1081.90~20.04.1
  • 5.15.0-1082.91~20.04.1
  • 5.15.0-1086.95~20.04.1
  • 5.15.0-1087.96~20.04.1
  • 5.15.0-1088.97~20.04.1
  • 5.15.0-1089.98~20.04.1
Ubuntu 22.04 Released
97 kernels
  • 5.15.0-27.28
  • 5.15.0-33.34
  • 5.15.0-37.39
  • 5.15.0-39.42
  • 5.15.0-25.25
  • 5.15.0-28.29
  • 5.15.0-29.30
  • 5.15.0-30.31
  • 5.15.0-41.44
  • 5.15.0-43.46
  • 5.15.0-46.49
  • 5.15.0-35.36
  • 5.15.0-47.51
  • 5.15.0-48.54
  • 5.15.0-40.43
  • 5.15.0-50.56
  • 5.15.0-52.58
  • 5.15.0-53.59
  • 5.15.0-56.62
  • 5.15.0-54.60
  • 5.15.0-57.63
  • 5.15.0-58.64
  • 5.15.0-60.66
  • 5.15.0-67.74
  • 5.15.0-69.76
  • 5.15.0-70.77
  • 5.15.0-71.78
  • 5.15.0-72.79
  • 5.15.0-68.75
  • 5.15.0-73.80
  • 5.15.0-75.82
  • 5.15.0-76.83
  • 5.15.0-78.85
  • 5.15.0-79.86
  • 5.15.0-82.91
  • 5.15.0-83.92
  • 5.15.0-84.93
  • 5.15.0-86.96
  • 5.15.0-74.81
  • 5.15.0-87.97
  • 5.15.0-88.98
  • 5.15.0-89.99
  • 5.15.0-91.101
  • 5.15.0-92.102
  • 5.15.0-94.104
  • 5.15.0-97.107
  • 5.15.0-100.110
  • 5.15.0-101.111
  • 5.15.0-102.112
  • 5.15.0-105.115
  • 5.15.0-106.116
  • 5.15.0-107.117
  • 5.15.0-112.122
  • 5.15.0-113.123
  • 5.15.0-116.126
  • 5.15.0-117.127
  • 5.15.0-118.128
  • 5.15.0-119.129
  • 5.15.0-121.131
  • 5.15.0-122.132
  • 5.15.0-124.134
  • 5.15.0-125.135
  • 5.15.0-127.137
  • 5.15.0-130.140
  • 5.15.0-126.136
  • 5.15.0-131.141
  • 5.15.0-128.138
  • 5.15.0-133.144
  • 5.15.0-134.145
  • 5.15.0-135.146
  • 5.15.0-136.147
  • 5.15.0-138.148
  • 5.15.0-139.149
  • 5.15.0-140.150
  • 5.15.0-141.151
  • 5.15.0-142.152
  • 5.15.0-143.153
  • 5.15.0-144.157
  • 5.15.0-151.161
  • 5.15.0-152.162
  • 5.15.0-153.163
  • 5.15.0-156.166
  • 5.15.0-157.167
  • 5.15.0-160.170
  • 5.15.0-161.171
  • 5.15.0-163.173
  • 5.15.0-164.174
  • 5.15.0-168.178
  • 5.15.0-170.180
  • 5.15.0-171.181
  • 5.15.0-173.183
  • 5.15.0-174.184
  • 5.15.0-176.186
  • 5.15.0-177.187
  • 5.15.0-179.189
  • 5.15.0-181.191
  • 5.15.0-185.195
Ubuntu 22.04 AWS Released
88 kernels
  • 5.15.0-1005.7
  • 5.15.0-1008.10
  • 5.15.0-1011.14
  • 5.15.0-1013.17
  • 5.15.0-1015.19
  • 5.15.0-1017.21
  • 5.15.0-1009.11
  • 5.15.0-1020.24
  • 5.15.0-1021.25
  • 5.15.0-1022.26
  • 5.15.0-1023.27
  • 5.15.0-1026.30
  • 5.15.0-1004.6
  • 5.15.0-1014.18
  • 5.15.0-1018.22
  • 5.15.0-1024.29
  • 5.15.0-1027.31
  • 5.15.0-1028.32
  • 5.15.0-1030.34
  • 5.15.0-1031.35
  • 5.15.0-1033.37
  • 5.15.0-1034.38
  • 5.15.0-1035.39
  • 5.15.0-1036.40
  • 5.15.0-1032.36
  • 5.15.0-1037.41
  • 5.15.0-1038.43
  • 5.15.0-1039.44
  • 5.15.0-1040.45
  • 5.15.0-1042.47
  • 5.15.0-1043.48
  • 5.15.0-1044.49
  • 5.15.0-1045.50
  • 5.15.0-1047.52
  • 5.15.0-1048.53
  • 5.15.0-1049.54
  • 5.15.0-1050.55
  • 5.15.0-1051.56
  • 5.15.0-1052.57
  • 5.15.0-1053.58
  • 5.15.0-1055.60
  • 5.15.0-1056.61
  • 5.15.0-1057.63
  • 5.15.0-1060.66
  • 5.15.0-1061.67
  • 5.15.0-1062.68
  • 5.15.0-1063.69
  • 5.15.0-1064.70
  • 5.15.0-1065.71
  • 5.15.0-1066.72
  • 5.15.0-1067.73
  • 5.15.0-1068.74
  • 5.15.0-1069.75
  • 5.15.0-1070.76
  • 5.15.0-1071.77
  • 5.15.0-1072.78
  • 5.15.0-1073.79
  • 5.15.0-1076.83
  • 5.15.0-1078.85
  • 5.15.0-1079.86
  • 5.15.0-1080.87
  • 5.15.0-1081.88
  • 5.15.0-1082.89
  • 5.15.0-1083.90
  • 5.15.0-1084.91
  • 5.15.0-1085.92
  • 5.15.0-1086.93
  • 5.15.0-1087.94
  • 5.15.0-1088.95
  • 5.15.0-1089.96
  • 5.15.0-1090.97
  • 5.15.0-1091.98
  • 5.15.0-1092.99
  • 5.15.0-1093.100
  • 5.15.0-1095.102
  • 5.15.0-1096.103
  • 5.15.0-1097.104
  • 5.15.0-1098.105
  • 5.15.0-1099.106
  • 5.15.0-1100.107
  • 5.15.0-1101.108
  • 5.15.0-1103.110
  • 5.15.0-1104.111
  • 5.15.0-1105.112
  • 5.15.0-1106.113
  • 5.15.0-1108.115
  • 5.15.0-1109.116
  • 5.15.0-1111.118
Ubuntu 22.04 Azure Released
78 kernels
  • 5.15.0-1005.6
  • 5.15.0-1007.8
  • 5.15.0-1010.12
  • 5.15.0-1012.15
  • 5.15.0-1014.17
  • 5.15.0-1017.20
  • 5.15.0-1008.9
  • 5.15.0-1019.24
  • 5.15.0-1020.25
  • 5.15.0-1021.26
  • 5.15.0-1022.27
  • 5.15.0-1003.4
  • 5.15.0-1013.16
  • 5.15.0-1023.29
  • 5.15.0-1029.36
  • 5.15.0-1024.30
  • 5.15.0-1034.41
  • 5.15.0-1035.42
  • 5.15.0-1036.43
  • 5.15.0-1037.44
  • 5.15.0-1038.45
  • 5.15.0-1039.46
  • 5.15.0-1040.47
  • 5.15.0-1041.48
  • 5.15.0-1042.49
  • 5.15.0-1045.52
  • 5.15.0-1046.53
  • 5.15.0-1047.54
  • 5.15.0-1049.56
  • 5.15.0-1044.51
  • 5.15.0-1050.57
  • 5.15.0-1051.59
  • 5.15.0-1052.60
  • 5.15.0-1053.61
  • 5.15.0-1054.62
  • 5.15.0-1056.64
  • 5.15.0-1057.65
  • 5.15.0-1058.66
  • 5.15.0-1059.67
  • 5.15.0-1060.69
  • 5.15.0-1061.70
  • 5.15.0-1063.72
  • 5.15.0-1064.73
  • 5.15.0-1066.75
  • 5.15.0-1067.76
  • 5.15.0-1068.77
  • 5.15.0-1070.79
  • 5.15.0-1071.80
  • 5.15.0-1072.81
  • 5.15.0-1073.82
  • 5.15.0-1074.83
  • 5.15.0-1075.84
  • 5.15.0-1078.87
  • 5.15.0-1079.88
  • 5.15.0-1081.90
  • 5.15.0-1082.91
  • 5.15.0-1084.93
  • 5.15.0-1086.95
  • 5.15.0-1087.96
  • 5.15.0-1088.97
  • 5.15.0-1089.98
  • 5.15.0-1090.99
  • 5.15.0-1091.100
  • 5.15.0-1092.101
  • 5.15.0-1094.103
  • 5.15.0-1095.104
  • 5.15.0-1096.105
  • 5.15.0-1097.106
  • 5.15.0-1098.107
  • 5.15.0-1101.110
  • 5.15.0-1102.111
  • 5.15.0-1099.108
  • 5.15.0-1103.112
  • 5.15.0-1109.118
  • 5.15.0-1110.119
  • 5.15.0-1111.120
  • 5.15.0-1114.123
  • 5.15.0-1116.125
Ubuntu 24.04 Released
46 kernels
  • 6.8.0-35.35
  • 6.8.0-38.38
  • 6.8.0-36.36
  • 6.8.0-39.39
  • 6.8.0-40.40
  • 6.8.0-41.41
  • 6.8.0-44.44
  • 6.8.0-45.45
  • 6.8.0-31.31
  • 6.8.0-47.47
  • 6.8.0-48.48
  • 6.8.0-49.49
  • 6.8.0-50.51
  • 6.8.0-51.52
  • 6.8.0-52.53
  • 6.8.0-54.56
  • 6.8.0-55.57
  • 6.8.0-53.55
  • 6.8.0-56.58
  • 6.8.0-57.59
  • 6.8.0-58.60
  • 6.8.0-59.61
  • 6.8.0-60.63
  • 6.8.0-62.65
  • 6.8.0-63.66
  • 6.8.0-64.67
  • 6.8.0-71.71
  • 6.8.0-78.78
  • 6.8.0-79.79
  • 6.8.0-84.84
  • 6.8.0-85.85
  • 6.8.0-83.83
  • 6.8.0-86.87
  • 6.8.0-87.88
  • 6.8.0-88.89
  • 6.8.0-90.91
  • 6.8.0-94.96
  • 6.8.0-100.100
  • 6.8.0-101.101
  • 6.8.0-106.106
  • 6.8.0-107.107
  • 6.8.0-110.110
  • 6.8.0-111.111
  • 6.8.0-117.117
  • 6.8.0-124.124
  • 6.8.0-134.134