CVE-2026-52998

netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

State: Published
Severity: 7.5 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid.

Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching.

Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttl_check.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before f4de0777e4554a7de19c920accde6319dd530782Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before c996a90f3071cf43683e5423da31aadbe002b8b4Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before edc806f9122961f0d3819f7c69c14cccde31f277Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 5d05de2f0928d81309a815ecc76d1a3ad72cbc16Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 95be653a76793856ff8b2d8bd82c2943c23f5ca8Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 79b90a96688e521771fa6ed3dc7864b76b8df293Affected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 83fc5dd63455a779ea2dd0f7ffee3c920919d80bAffected 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 711987ba281fd806322a7cd244e98e2a81903114Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before f4de0777e4554a7de19c920accde6319dd530782Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before c996a90f3071cf43683e5423da31aadbe002b8b4Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before edc806f9122961f0d3819f7c69c14cccde31f277Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 5d05de2f0928d81309a815ecc76d1a3ad72cbc16Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 95be653a76793856ff8b2d8bd82c2943c23f5ca8Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 79b90a96688e521771fa6ed3dc7864b76b8df293Affected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 83fc5dd63455a779ea2dd0f7ffee3c920919d80bAffected
11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 to before 711987ba281fd806322a7cd244e98e2a81903114Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.