CVE-2026-45841

netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

State: Published
Severity: Not scored
Published: May 27, 2026
Updated: Oct 15, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

nf_osf_match_one() computes ctx->window % f->wss.val in the OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a subsequent matching TCP SYN divides by zero and panics the kernel.

Reject the bogus fingerprint in nfnl_osf_add_callback() above the per-option for-loop. f->wss is per-fingerprint, not per-option, so the check must run regardless of f->opt_num (including 0). Also reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that as "should not happen".

Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: <IRQ> nf_osf_match (net/netfilter/nfnetlink_osf.c:220) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:348) nf_hook_slow (net/netfilter/core.c:622) ip_local_deliver (net/ipv4/ip_input.c:265) ip_rcv (include/linux/skbuff.h:1162) __netif_receive_skb_one_core (net/core/dev.c:6181) process_backlog (net/core/dev.c:6642) __napi_poll (net/core/dev.c:7710) net_rx_action (net/core/dev.c:7945) handle_softirqs (kernel/softirq.c:622)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before cb833bbc1b3c51e08652d3c86298307c07d3f2dbAffected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 26900306a5a2c3e4f75c643a064525526bb6e5f3Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 0694618cf3e9b120666e31f5f383a6e466d95a0dAffected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 8def8fbd23f40e945febe913d04b731012ce0082Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before c55940895245d8ef658ab381248a28755218d625Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2fAffected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 9a05e195618a6d474f2bcd5b6376d0ffc2f00366Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 2195574dc6d9017d32ac346987e12659f931d932Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before cb833bbc1b3c51e08652d3c86298307c07d3f2dbAffected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 26900306a5a2c3e4f75c643a064525526bb6e5f3Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 0694618cf3e9b120666e31f5f383a6e466d95a0dAffected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 8def8fbd23f40e945febe913d04b731012ce0082Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before c55940895245d8ef658ab381248a28755218d625Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2fAffected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 9a05e195618a6d474f2bcd5b6376d0ffc2f00366Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 2195574dc6d9017d32ac346987e12659f931d932Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.