CVE-2026-46244

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-46244
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601 Patch
https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582 Patch
https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c Patch
https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273 Patch
https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*
History

09 Jun 2026, 20:35

Type Values Removed Values Added
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601 - () https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601 - Patch
References () https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582 - () https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582 - Patch
References () https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c - () https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c - Patch
References () https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273 - () https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273 - Patch
References () https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce - () https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce - Patch

05 Jun 2026, 07:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1

03 Jun 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-03 18:16

Updated : 2026-06-09 20:35

NVD link : CVE-2026-46244

Mitre link : CVE-2026-46244

CVE.ORG link : CVE-2026-46244

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo