CVE-2026-97417: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrack: use getunalignedbe32() in tcpsack()
The timestamp-only fast path dereferences the option stream as (be32 )ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use getunalignedbe32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped.
This matches the existing getunalignedbe32() use later in the same function.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Linux systems that process TCP traffic through netfilter connection tracking and execute the affected TCP SACK parsing path may be exposed. The issue depends on TCP option data that is not 4-byte aligned.
What does an attacker need to do to trigger it?
An attacker would need to cause the kernel's conntrack TCP SACK handling to parse a TCP option stream at an unaligned address. The provided data does not specify authentication, local access, or other prerequisites.
What can be done if patching is not immediately possible?
The provided data identifies no documented workaround. The corrective change is to use get_unaligned_be32() for the timestamp-only fast-path read in tcp_sack().
How can I determine whether the fix is present?
Check whether your kernel includes one of the referenced stable commits: 7ecfa46a536578a7ed335ddf31a854127268c27c, 4abc1af7ac209c066f4e5dd75cdd56876e5829a9, or d3bf9eae486490832bd08fd62ab0ac601f346bd4.