CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6thbh: reject oversized option lists
struct ip6topts stores at most IP6TOPTSOPTSNR option descriptors, but hbhmt6check() does not reject larger optsnr values supplied from userspace.
Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged.
struct ip6topts has a fixed opts[IP6TOPTSOPTSNR] array, where IP6TOPTSOPTSNR is 16, then off-by-one array access is possible:
[ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6thbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type 'u16 [16]'
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Update the Linux kernel netfilter ip6t_hbh rule validation (hbh_mt6_check()/checkentry path) to validate optsnr so only match data that fits struct ip6t_opts fixed array IP6T_OPTS_OPTSNR is accepted; reject oversized option lists to prevent out-of-bounds access in ../net/ipv6/netfilter/ip6t_hbh.c.
Linux kernel netfilter (ip6t_hbh / hbh_mt6_check) reject oversized option lists by validating optsnr in rule setup path = must reject optsnr values larger than the fixed array size (IP6T_OPTS_OPTSNR = 16)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52915?
The severity of CVE-2026-52915 is rated at 38, indicating a moderate risk.
How do I fix CVE-2026-52915?
To fix CVE-2026-52915, update your Linux kernel to the latest version where this vulnerability has been addressed.
What impact does CVE-2026-52915 have on system security?
CVE-2026-52915 allows userspace to supply oversized option lists to ip6t_hbh, which may lead to improper kernel behavior.
Which versions of Linux are affected by CVE-2026-52915?
CVE-2026-52915 affects versions of the Linux kernel that utilize the netfilter ip6t_hbh module.
Is CVE-2026-52915 a remote vulnerability?
CVE-2026-52915 is primarily a local vulnerability that can be exploited by authenticated users on the system.