CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlinkosf: fix potential NULL dereference in ttl check
The nfosfttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid.
Additionally, the implementation utilized an indevforeachifarcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching.
Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttlcheck.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - Compensating control
Apply the kernel fix so ttl_check no longer dereferences skb->dev without verifying the device pointer is valid (fix potential NULL dereference in nfnetlink_osf TTL check).
Event History
Frequently Asked Questions
What is the practical impact of successful exploitation?
The vulnerability can cause a kernel NULL pointer dereference, resulting in a denial of service through system instability or a crash. The provided severity vector indicates network-based exploitation requires no privileges or user interaction.
Which systems are identified as affected?
The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1. The data does not identify specific kernel version ranges or configuration prerequisites beyond the nfnetlink_osf code path.
What changed in the fix?
The fix removes access to skb->dev and the local-interface address iteration used during TTL checking. TTL handling is replaced with a switch statement based on the ttl_check setting, avoiding the invalid device-pointer dereference and subnet-assumption logic.