{"id":"CVE-2026-80637","state":"PUBLISHED","title":"netfilter: synproxy: fix unaligned memory access in timestamp adjustment","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\n\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\nwrite the timestamp fields. This prevents performance degradation due to\nunaligned memory access or even a crash on strict alignment\narchitectures.\n\nThis follows the implementation of timestamp parsing in the networking\nstack at tcp_parse_options() and synproxy_parse_options().","publishedAt":"2026-08-28T06:48:50.836Z","updatedAt":"2026-10-30T12:30:49.999Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"b30a2d56ee47282f6a46cb2f50e315b2414851fe","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"95cda0446f51077c343fdd8264be2737eb25a6c3","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"5c9c67cf7a3d16051dfb90e98836f530964dfb8e","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"992c20bc8a4aba220c8b95b467d049289778dad6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_synproxy_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.12","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_synproxy_core.c"]}],"references":["https://git.kernel.org/stable/c/b30a2d56ee47282f6a46cb2f50e315b2414851fe","https://git.kernel.org/stable/c/95cda0446f51077c343fdd8264be2737eb25a6c3","https://git.kernel.org/stable/c/2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4","https://git.kernel.org/stable/c/5c9c67cf7a3d16051dfb90e98836f530964dfb8e","https://git.kernel.org/stable/c/ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7","https://git.kernel.org/stable/c/992c20bc8a4aba220c8b95b467d049289778dad6"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80637.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80637","state":"PUBLISHED","datePublished":"2026-08-28T06:48:50.836Z","dateUpdated":"2026-10-30T12:30:49.999Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.777Z"},"containers":{"cna":{"title":"netfilter: synproxy: fix unaligned memory access in timestamp adjustment","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\n\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\nwrite the timestamp fields. This prevents performance degradation due to\nunaligned memory access or even a crash on strict alignment\narchitectures.\n\nThis follows the implementation of timestamp parsing in the networking\nstack at tcp_parse_options() and synproxy_parse_options()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"b30a2d56ee47282f6a46cb2f50e315b2414851fe","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"95cda0446f51077c343fdd8264be2737eb25a6c3","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"5c9c67cf7a3d16051dfb90e98836f530964dfb8e","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","status":"affected","lessThan":"992c20bc8a4aba220c8b95b467d049289778dad6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_synproxy_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.12","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_synproxy_core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b30a2d56ee47282f6a46cb2f50e315b2414851fe"},{"url":"https://git.kernel.org/stable/c/95cda0446f51077c343fdd8264be2737eb25a6c3"},{"url":"https://git.kernel.org/stable/c/2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4"},{"url":"https://git.kernel.org/stable/c/5c9c67cf7a3d16051dfb90e98836f530964dfb8e"},{"url":"https://git.kernel.org/stable/c/ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7"},{"url":"https://git.kernel.org/stable/c/992c20bc8a4aba220c8b95b467d049289778dad6"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - synproxy_tstamp_adjust() runs in ipv4/ipv6_synproxy_hook on received TCP segments after SYNPROXY handshake; internet-facing gateways with SYNPROXY enabled process attacker-crafted inbound packets, matching CNA precedent for remote synproxy packet bugs.\nAC:L - Once SYNPROXY with timestamps is active and tsoff is set, the attacker fully controls TCP option layout and can reliably place TCPOPT_TIMESTAMP so op[2]/op[6] are 2-mod-4 unaligned (e.g. MSS+SACK_PERM+two NOPs+TIMESTAMP), deterministically hitting the misaligned __be32 access.\nPR:N - Exploitation requires only sending TCP traffic to a host where an administrator already enabled SYNPROXY/nftables synproxy with timestamps; the remote attacker needs no local account, capability, or authentication on the target.\nUI:N - The netfilter hook processes matching TCP segments automatically during normal connection handling; no victim user action beyond routine network connectivity to the protected service is required.\nS:U - An alignment fault in synproxy timestamp adjustment panics or oopses the host kernel but does not cross VM, container, IOMMU, or other security boundaries; impact remains within the same kernel authority.\nC:N - The flaw is misaligned load/store of the packet's own TCP timestamp fields inside the skb buffer, not an out-of-bounds or use-after-free read of kernel memory; on strict-alignment architectures it faults immediately without disclosing attacker-inaccessible data.\nI:N - No kernel metadata or adjacent structures are corrupted; the write only adjusts the intended timestamp value in the TCP option bytes, and strict-alignment targets fault before any unintended modification can occur.\nA:H - The commit and fault mechanism confirm that direct misaligned __be32 dereference on strict-alignment architectures (e.g. SPARC, some ARM) causes a kernel alignment fault/oops/panic, fully denying availability on SYNPROXY-protected gateways and embedded routers."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:30:49.999Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-80637","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T19:19:14.142885Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:31.587Z"}}]}}}