CVE-2026-52915

netfilter: ip6t_hbh: reject oversized option lists

State: Published
Severity: 7.1 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_hbh: reject oversized option lists

struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace.

Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged.

`struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array, where `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible:

[ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]'

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2d523ba48d4ecc46acfb6aba548292cfcce1ac02Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 588933f1a2ca5ff99274f8c9f25dc3a25d0191c3Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 784aadea7a108c9f90985683caa87fb0198c6a39Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 41ec2e242f1702e8370ddfe14d22b7a766021c3eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before db0250470f023f159094052c0bd5ab026a88ae93Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 57b0ac5e1b46f1f0338dff392ef2092e2871b412Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6feb43c0995ab3a9c826707eb46541a1696fe4f7Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4322dcde6b4173c2d8e8e6118ed290794263bcc8Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2d523ba48d4ecc46acfb6aba548292cfcce1ac02Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 588933f1a2ca5ff99274f8c9f25dc3a25d0191c3Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 784aadea7a108c9f90985683caa87fb0198c6a39Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 41ec2e242f1702e8370ddfe14d22b7a766021c3eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before db0250470f023f159094052c0bd5ab026a88ae93Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 57b0ac5e1b46f1f0338dff392ef2092e2871b412Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6feb43c0995ab3a9c826707eb46541a1696fe4f7Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4322dcde6b4173c2d8e8e6118ed290794263bcc8Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.