netfilter: nft_inner: Fix IPv6 inner_thoff desync
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.142, 6.12.92, 6.18.34, 7.0.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 3a07327d10a09379315c844c63f27941f5081e0a · fixed in c161ad9157f5a0429b5ff94d9770faf3bf48d273; From 3a07327d10a09379315c844c63f27941f5081e0a · fixed in 870d59e2cf218e7418491e26bad768cb16654582; From 3a07327d10a09379315c844c63f27941f5081e0a · fixed in 689bbf48c1f45130086ae1c46ab83ea4c753c601; From 3a07327d10a09379315c844c63f27941f5081e0a · fixed in d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce; From 3a07327d10a09379315c844c63f27941f5081e0a · fixed in b6a91f68ebfed9c38e0e9150f58a9b85da07181c
- Linux Linux
6.2
- KernelLinux
From 6.2.0 · fixed in 6.6.142; From 6.7.0 · fixed in 6.12.92; From 6.13.0 · fixed in 6.18.34; From 6.19.0 · fixed in 7.0.11