CVE-2026-46244

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: Fix IPv6 inner_thoff desync

In nft_inner_parse_l2l3(), when processing inner IPv6 packets,

ipv6_find_hdr() correctly computes the transport header offset

traversing all extension headers, but the result is immediately

overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only

accounts for the IPv6 base header. This creates a desync between

inner_thoff (wrong — points to extension header start) and l4proto

(correct — e.g., IPPROTO_TCP), enabling transport header forgery

and potential firewall bypass. This issue affects stable versions

from Linux 6.2.

For comparison, the normal (non-inner) IPv6 path correctly

preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite

ensures that ipv6_find_hdr()'s calculated transport header offset is

preserved, thereby fixing the desynchronization.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References