CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftinner: Fix IPv6 innerthoff desync
In nftinnerparsel2l3(), when processing inner IPv6 packets, ipv6findhdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between innerthoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTOTCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2.
For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6findhdr()'s result. Removing the incorrect overwrite ensures that ipv6findhdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
Linux kernel (netfilter: nft_inner: Fix IPv6 inner_thoff desync)to a version that resolves this vulnerability.Fixed in 6.2 - Configuration
Apply the kernel fix for 'netfilter: nft_inner: Fix IPv6 inner_thoff desync' so that in nft_inner_parse_l2l3() the IPv6 inner transport header offset is preserved (do not overwrite inner_thoff with nhoff + sizeof(_ip6h) (40 bytes)), preventing desynchronization and potential firewall bypass.
Linux netfilter (nftables) - nft_inner_parse_l2l3 / IPv6 inner packet handling Remove the incorrect overwrite of inner_thoff = implemented by preserving ipv6_find_hdr()'s computed transport header offset
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46244?
The severity of CVE-2026-46244 is critical, with a CVSS score of 9.1.
How do I fix CVE-2026-46244?
You can fix CVE-2026-46244 by applying the available patch.
What type of vulnerability is CVE-2026-46244?
CVE-2026-46244 is a desynchronization vulnerability in the Linux kernel's netfilter component.
Which software is affected by CVE-2026-46244?
CVE-2026-46244 affects the Linux kernel.
When was CVE-2026-46244 published?
CVE-2026-46244 was published on June 3, 2026.