netfilter: conntrack: add missing netlink policy validations (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.
Weaknesses (CWE)
References
- https://git.kernel.org/stable/c/e7b5766693477c52424cc6c79dd30a7a9c7db52c
- https://git.kernel.org/stable/c/78bba9f73942aa7dca47d817d8cec0fb9b443b70
- https://git.kernel.org/stable/c/be88a337bf07afb1ee173f1099294d1b7ab3fefe
- https://git.kernel.org/stable/c/c5e918390002edf0cff80a0e7ce1f86f16a9507c
- https://git.kernel.org/stable/c/9174d28f3f15d8c4962f5980c0be167633880443
- https://git.kernel.org/stable/c/67c53c1978cef3c504237275e39c857e2f6af56e
- https://git.kernel.org/stable/c/0fbae1e74493d5a160a70c51aeba035d8266ea7d
- https://git.kernel.org/stable/c/f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-19197
- GCVE · GCVE-0-2026-31407
CERT-FR advisories
- CERTFR-2026-AVI-1298 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0862 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0697 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0664 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 2.6.27 < 6.6.136cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.83cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.24cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.10cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < e7b5766693477c52424cc6c79dd30a7a9c7db52c ; affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < 78bba9f73942aa7dca47d817d8cec0fb9b443b70 ; affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < be88a337bf07afb1ee173f1099294d1b7ab3fefe ; affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < c5e918390002edf0cff80a0e7ce1f86f16a9507c ; affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < 9174d28f3f15d8c4962f5980c0be167633880443 ; affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < 67c53c1978cef3c504237275e39c857e2f6af56e |
| Linux · Linux | affected 2.6.27 ; unaffected 0 < 2.6.27 ; unaffected 5.10.258 ≤ 5.10.* ; unaffected 5.15.209 ≤ 5.15.* ; unaffected 6.1.175 ≤ 6.1.* ; unaffected 6.6.136 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |