Skip to main content

Linux Kernel CVE-2026-52998

| EUVDEUVD-2026-38866 HIGH
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-pphc-92v7-v4w2
Denial Of Service Linux Null Pointer Dereference
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it requires a non-default osf ruleset plus the specific NULL skb->dev path; availability-only impact (A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:45 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid.

Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching.

Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttl_check.

AnalysisAI

Kernel panic (denial of service) in the Linux kernel netfilter nfnetlink_osf module occurs because nf_osf_ttl() dereferences skb->dev during its TTL check without validating the device pointer, allowing a crafted packet to trigger a NULL pointer dereference on hosts using the OS-fingerprint (osf) match. The flaw affects systems with nftables/iptables rulesets that employ the osf TTL check, and is rated availability-only impact (CVSS 7.5, AV:N/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not in CISA KEV; the fix has been merged across multiple stable trees.

Technical ContextAI

The vulnerability lives in the netfilter passive OS fingerprinting subsystem (nfnetlink_osf), which lets nftables/iptables match packets against known TCP/IP OS signatures. The nf_osf_ttl() helper compares a packet's IP TTL against expected values; the buggy implementation read skb->dev and walked local interface addresses via in_dev_for_each_ifa_rcu to decide whether a packet originated from the same subnet (and thus should not have a decremented TTL). Because skb->dev can be NULL on certain code paths, the unchecked dereference is a classic NULL pointer dereference (CWE-476). The CPE data identifies the affected component generically as cpe:2.3:a:linux:linux, i.e. the upstream Linux kernel. The fix removes the device dereference and the interface loop entirely, replacing the subnet heuristic with a switch statement that evaluates TTL purely from the configured ttl_check value - also correcting a logic flaw where containerized/virtual-switched packets could be misjudged as same-subnet.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel for your branch: 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, or 6.18.33 (or later within the series), per the stable commits at https://git.kernel.org/stable/c/f4de0777e4554a7de19c920accde6319dd530782 and the related commits listed in EUVD-2026-38866; distribution users should take their vendor's corresponding kernel update. If you cannot patch immediately, the most effective compensating control is to remove or avoid osf-based matching in your firewall ruleset - drop nftables/iptables rules that use the 'osf' match (the only code path that reaches nf_osf_ttl), which closes the trigger entirely at the cost of losing passive OS-fingerprint filtering. Where osf is not actually needed, ensure the xt_osf/nfnetlink_osf module is not loaded. Standard kernel-DoS hygiene (upstream ingress filtering of malformed packets, monitoring for unexpected kernel oops/panics) provides partial defense but does not remove the underlying NULL dereference.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-52998 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy