{"id":"CVE-2026-43452","state":"PUBLISHED","title":"netfilter: x_tables: guard option walkers against 1-byte tail reads","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i == optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers.","publishedAt":"2026-05-08T14:22:17.361Z","updatedAt":"2026-10-19T19:26:36.945Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"c2a445367a496a3c25dbc940c10c8bd1cfd4c14a","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"ae1e1267650638136b84c23f2b31250f0ccb6823","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"c39f84e4be1be63fc60ca7141ea7b76edcea5907","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"9b94f0e42ed248eb31929da84ed9f5310d7ff540","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"bc18551c6169eac5ed813778d3e3e484002dbbe5","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"d04800323336eebf441d153f43234eac9b833d36","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"cfe770220ac2dbd3e104c6b45094037455da81d4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/xt_dccp.c","net/netfilter/xt_tcpudp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.16","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.19","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.9","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/xt_dccp.c","net/netfilter/xt_tcpudp.c"]}],"references":["https://git.kernel.org/stable/c/c2a445367a496a3c25dbc940c10c8bd1cfd4c14a","https://git.kernel.org/stable/c/ae1e1267650638136b84c23f2b31250f0ccb6823","https://git.kernel.org/stable/c/c39f84e4be1be63fc60ca7141ea7b76edcea5907","https://git.kernel.org/stable/c/9b94f0e42ed248eb31929da84ed9f5310d7ff540","https://git.kernel.org/stable/c/5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c","https://git.kernel.org/stable/c/bc18551c6169eac5ed813778d3e3e484002dbbe5","https://git.kernel.org/stable/c/d04800323336eebf441d153f43234eac9b833d36","https://git.kernel.org/stable/c/cfe770220ac2dbd3e104c6b45094037455da81d4"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43452.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43452","state":"PUBLISHED","datePublished":"2026-05-08T14:22:17.361Z","dateUpdated":"2026-10-19T19:26:36.945Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:56.010Z"},"containers":{"cna":{"title":"netfilter: x_tables: guard option walkers against 1-byte tail reads","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i == optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"c2a445367a496a3c25dbc940c10c8bd1cfd4c14a","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"ae1e1267650638136b84c23f2b31250f0ccb6823","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"c39f84e4be1be63fc60ca7141ea7b76edcea5907","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"9b94f0e42ed248eb31929da84ed9f5310d7ff540","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"bc18551c6169eac5ed813778d3e3e484002dbbe5","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"d04800323336eebf441d153f43234eac9b833d36","versionType":"git"},{"version":"2e4e6a17af35be359cc8f1c924f8f198fbd478cc","status":"affected","lessThan":"cfe770220ac2dbd3e104c6b45094037455da81d4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/xt_dccp.c","net/netfilter/xt_tcpudp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.16","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.19","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.9","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/xt_dccp.c","net/netfilter/xt_tcpudp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c2a445367a496a3c25dbc940c10c8bd1cfd4c14a"},{"url":"https://git.kernel.org/stable/c/ae1e1267650638136b84c23f2b31250f0ccb6823"},{"url":"https://git.kernel.org/stable/c/c39f84e4be1be63fc60ca7141ea7b76edcea5907"},{"url":"https://git.kernel.org/stable/c/9b94f0e42ed248eb31929da84ed9f5310d7ff540"},{"url":"https://git.kernel.org/stable/c/5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c"},{"url":"https://git.kernel.org/stable/c/bc18551c6169eac5ed813778d3e3e484002dbbe5"},{"url":"https://git.kernel.org/stable/c/d04800323336eebf441d153f43234eac9b833d36"},{"url":"https://git.kernel.org/stable/c/cfe770220ac2dbd3e104c6b45094037455da81d4"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - In a reasonable highest-impact deployment, an internet-facing host or firewall has an x_tables TCP/DCCP option match rule installed, and the vulnerable walker is then reached by unauthenticated network packets. A remote attacker can craft TCP or DCCP options ending with a non-single-byte option kind to trigger the tail read.\nAC:L - The trigger is deterministic packet content: make the last option byte a kind value >= 2 without a following length byte. There is no race, timing requirement, or attacker-uncontrolled memory layout condition needed to reach the bug.\nPR:N - The network packet path requires no local account or authentication once the affected rule is present. Although local rule installation is gated by CAP_NET_ADMIN in the network namespace and is user-namespace reachable, the highest reasonable trigger path is unauthenticated remote traffic.\nUI:N - No victim user action is required for each exploit attempt. The attacker only sends crafted packets to a system whose netfilter rules inspect TCP or DCCP options.\nS:U - The vulnerable code executes in the target kernel’s own netfilter packet-processing context. It does not cross a separate security authority such as a VM or device/IOMMU boundary.\nC:L - The primitive is a strictly bounded one-byte out-of-bounds read past the option area, not an arbitrary read primitive. Because it can access adjacent kernel memory, limited confidentiality impact is the higher defensible value.\nI:N - The bug performs only an out-of-bounds read of op[i + 1]; it does not write memory or corrupt kernel structures. The read byte only affects loop advancement at the tail and does not provide an integrity-changing primitive.\nA:H - Malformed packets can repeatedly trigger a kernel out-of-bounds read in the netfilter hot path. On hardened, sanitizing, or faulting deployments this can produce an oops or panic, so availability impact is high."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:28:01.123Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"6.1.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"6.6.130"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"6.12.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"6.18.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"6.19.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.16","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-43452","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:17:27.922262Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:26:36.945Z"}}]}}}