CVE-2026-46244
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In the Linux kernel netfilter nft_inner module, there is a desynchronization between the transport offset and layer 4 protocol for inner IPv6 packets. The bug overwrites the correct offset calculated by ipv6_find_hdr() with a constant 40 bytes, enabling transport header forgery and potential firewall bypass. This affects stable kernel versions from 6.2.
Risk Assessment
An attacker can exploit this vulnerability to forge network traffic and bypass firewall rules, leading to unauthorized system access or data leakage.
Recommendation
Apply the Linux kernel patch that removes the incorrect offset overwrite in nft_inner_parse_l2l3() or update the kernel to a fixed version.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.