CVE-2026-52999

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nfnetlink_osf: fix out-of-bounds read on option matching<br /> <br /> In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once<br /> and passed by reference to nf_osf_match_one() for each fingerprint<br /> checked. During TCP option parsing, nf_osf_match_one() advances the<br /> shared ctx-&gt;optp pointer.<br /> <br /> If a fingerprint perfectly matches, the function returns early without<br /> restoring ctx-&gt;optp to its initial state. If the user has configured<br /> NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.<br /> However, because ctx-&gt;optp was not restored, the next call to<br /> nf_osf_match_one() starts parsing from the end of the options buffer.<br /> This causes subsequent matches to read garbage data and fail<br /> immediately, making it impossible to log more than one match or logging<br /> incorrect matches.<br /> <br /> Instead of using a shared ctx-&gt;optp pointer, pass the context as a<br /> constant pointer and use a local pointer (optp) for TCP option<br /> traversal. This makes nf_osf_match_one() strictly stateless from the<br /> caller&amp;#39;s perspective, ensuring every fingerprint check starts at the<br /> correct option offset.