CVE-2026-97417

netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

State: Published
Severity: 7.5 High
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped.

This matches the existing get_unaligned_be32() use later in the same function.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 740ad3d17a281f7764dda4dbeb37cea52e2e31aeAffected bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before a0523267de2523522b0f70972dd1ffa22ec6176cAffected bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 55bcc3376cd7b18954cc9814da697504fdaf12bfAffected bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 0d5ad732e4fdc569eb85861115e8f7b4c2c67852Affected bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 7ecfa46a536578a7ed335ddf31a854127268c27cAffected bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 4abc1af7ac209c066f4e5dd75cdd56876e5829a9Affected bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before d3bf9eae486490832bd08fd62ab0ac601f346bd4Affected
LinuxLinux	3.1Affected before 3.1Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 740ad3d17a281f7764dda4dbeb37cea52e2e31aeAffected
bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before a0523267de2523522b0f70972dd1ffa22ec6176cAffected
bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 55bcc3376cd7b18954cc9814da697504fdaf12bfAffected
bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 0d5ad732e4fdc569eb85861115e8f7b4c2c67852Affected
bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 7ecfa46a536578a7ed335ddf31a854127268c27cAffected
bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before 4abc1af7ac209c066f4e5dd75cdd56876e5829a9Affected
bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 to before d3bf9eae486490832bd08fd62ab0ac601f346bd4Affected

LinuxLinux

3.1Affected
before 3.1Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.