CVE-2026-23397

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfnetlink_osf: validate individual option lengths in fingerprints

nfnl_osf_add_callback() validates opt_num bounds and string

NUL-termination but does not check individual option length fields.

A zero-length option causes nf_osf_match_one() to enter the option

matching loop even when foptsize sums to zero, which matches packets

with no TCP options where ctx->optp is NULL:

Oops: general protection fault

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)

Call Trace:

nf_osf_match (net/netfilter/nfnetlink_osf.c:227)

xt_osf_match_packet (net/netfilter/xt_osf.c:32)

ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)

nf_hook_slow (net/netfilter/core.c:623)

ip_local_deliver (net/ipv4/ip_input.c:262)

ip_rcv (net/ipv4/ip_input.c:573)

Additionally, an MSS option (kind=2) with length < 4 causes

out-of-bounds reads when nf_osf_match_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References