CVE-2026-43452

netfilter: x_tables: guard option walkers against 1-byte tail reads

State: Published
Severity: 8.2 High
Published: May 8, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: guard option walkers against 1-byte tail reads

When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area.

Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before c2a445367a496a3c25dbc940c10c8bd1cfd4c14aAffected 2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before ae1e1267650638136b84c23f2b31250f0ccb6823Affected 2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before c39f84e4be1be63fc60ca7141ea7b76edcea5907Affected 2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before 9b94f0e42ed248eb31929da84ed9f5310d7ff540Affected 2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before 5b18b8b35c7cded2d17b2b2604c9b0694ff48d1cAffected 2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before bc18551c6169eac5ed813778d3e3e484002dbbe5Affected 2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before d04800323336eebf441d153f43234eac9b833d36Affected 2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before cfe770220ac2dbd3e104c6b45094037455da81d4Affected
LinuxLinux	2.6.16Affected before 2.6.16Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.19 through 6.18.Not affected 6.19.9 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before c2a445367a496a3c25dbc940c10c8bd1cfd4c14aAffected
2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before ae1e1267650638136b84c23f2b31250f0ccb6823Affected
2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before c39f84e4be1be63fc60ca7141ea7b76edcea5907Affected
2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before 9b94f0e42ed248eb31929da84ed9f5310d7ff540Affected
2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before 5b18b8b35c7cded2d17b2b2604c9b0694ff48d1cAffected
2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before bc18551c6169eac5ed813778d3e3e484002dbbe5Affected
2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before d04800323336eebf441d153f43234eac9b833d36Affected
2e4e6a17af35be359cc8f1c924f8f198fbd478cc to before cfe770220ac2dbd3e104c6b45094037455da81d4Affected

LinuxLinux

2.6.16Affected
before 2.6.16Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.19 through 6.18.*Not affected
6.19.9 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.