CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtables: guard option walkers against 1-byte tail reads
When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xttcpudp and xtdccp option walkers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Guard the option-walker loop so it performs an explicit `i == optlen - 1` check before dereferencing `op[i + 1]` (and before using it to advance `i += op[i + 1]`) when walking the xt_tcpudp and xt_dccp option area. The resolved change is: 'guard option walkers against 1-byte tail reads of the option area'.
Linux kernel netfilter x_tables option walkers (xt_tcpudp/xt_dccp) Add explicit boundary check before dereferencing op[i+1] = if (i == optlen - 1) { break/return safely; }
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43452?
CVE-2026-43452 is classified as a low-severity vulnerability in the Linux kernel affecting netfilter/x_tables.
How do I fix CVE-2026-43452?
To fix CVE-2026-43452, update the Linux kernel to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-43452?
CVE-2026-43452 affects the Linux kernel specifically in its netfilter/x_tables implementation.
What types of attacks can exploit CVE-2026-43452?
CVE-2026-43452 could potentially be exploited to cause unintended behavior or crashes in the networking stack.
Is CVE-2026-43452 mitigated by existing security measures?
While existing security measures may offer some protection, it is recommended to apply the latest updates to fully mitigate CVE-2026-43452.