Skip to main content

Linux Kernel EUVDEUVD-2026-34106

| CVE-2026-46244 CRITICAL
Use of Out-of-range Pointer Offset (CWE-823)
2026-06-03 Linux GHSA-fgx8-r5g7-5cr9
Authentication Bypass Linux Memory Corruption
Critical
Disputed · 9.1 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Linux gateway with nft_inner IPv6 rules
  2. Delivery
    Craft tunneled IPv6 packet with extension headers
  3. Exploit
    Send to target tunnel endpoint
  4. Execution
    nft_inner mis-parses inner_thoff vs l4proto
  5. Persist
    nftables rule evaluates wrong header bytes
  6. Impact
    Disallowed inner flow bypasses firewall policy

Vulnerability Assessment

Weakness
CWE
CWE-823
ASVS 5.0
V15 - Secure Coding and Architecture Use after free prevention
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target must be a Linux host running kernel 6.2 or later that processes tunneled traffic and has an nftables ruleset using the nft_inner expression to match on inner IPv6 payloads (typical of VXLAN/Geneve/IPIP6 decapsulation gateways, Kubernetes/overlay network nodes, or VPN concentrators that filter on the encapsulated flow). The attacker must be able to deliver IPv6 packets - encapsulated in the relevant tunnel - to that host, and the packets must include at least one IPv6 extension header before the transport header so that the 40-byte overwrite diverges from ipv6_find_hdr()'s true offset. Exploitation is limited to defeating the integrity/confidentiality of the nftables inner-match policy: hosts that do not use nft_inner inner-IPv6 matching are unaffected regardless of kernel version, and the bug does not yield code execution, privilege escalation, or denial of service (CVSS A:N). No authentication or user interaction is required at the network layer (PR:N/UI:N).
Impact

Signals diverge sharply on this one. The CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects an unauthenticated remote attacker able to send crafted IPv6 traffic and bypass firewall integrity/confidentiality controls, which is consistent with the netfilter context. However, EPSS sits at 0.02% (5th percentile), the CVE is not on CISA KEV, and no public exploit is identified - so observed and predicted exploitation activity is very low. The realistic prerequisite is also narrower than the CVSS vector suggests: a deployment must actually use nftables inner-header matching on tunneled IPv6 traffic (a relatively specialized configuration found on gateways, VPN concentrators, and container/overlay network hosts), so for hosts without such rules the practical impact is nil. The CVSS A:N is also worth noting - this is a policy-bypass bug, not RCE or DoS - meaning the 9.1 reads higher than the operational severity for most environments. Net: treat as a routine kernel security update for systems that run nftables inner matching on IPv6-capable tunnels; otherwise low priority.
Exploit ScenarioDerived

An attacker on a network path that reaches a Linux gateway running nftables inner-payload rules on tunneled IPv6 traffic crafts an encapsulated IPv6 packet containing one or more extension headers before the real transport protocol. Because nft_inner mis-parses inner_thoff while keeping the correct l4proto, the firewall evaluates the rule against the wrong bytes and admits traffic it should drop, allowing policy bypass to a service that nftables was supposed to protect. No public exploit is identified at time of analysis, but the primitive is straightforward to construct with standard packet-crafting tooling once an exposed configuration is identified.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Firewall bypass in the Linux kernel's netfilter nft_inner module (versions 6.2 and later) allows remote attackers to forge transport headers in tunneled IPv6 packets due to a desynchronization between the computed inner transport header offset and the parsed L4 protocol. The flaw enables crafted IPv6 packets carrying extension headers to evade nftables inner-payload matching rules, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating negligible observed exploitation activity.

RemediationAI

Vendor-released patch: upgrade to Linux 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1-rc5 (or later) per the stable-tree fix commits at git.kernel.org (c161ad9, 870d59e, 689bbf4, d0f98a3, b6a91f6); on distribution kernels, install the vendor kernel update that incorporates these backports once published. Reboot is required after the kernel upgrade to take effect. As a compensating control until patched, audit nftables rulesets and remove or restrict inner-header match expressions on tunneled IPv6 traffic (e.g., rules using the inner keyword for VXLAN/Geneve/IPIP6 decapsulation), accepting the side effect that policy granularity for tunneled IPv6 flows will be reduced to outer-header matching only. Where inner matching cannot be disabled, consider blocking or rate-limiting IPv6 traffic carrying extension headers (Hop-by-Hop, Routing, Destination Options, Fragment) at the network edge - note this can break legitimate uses such as Mobile IPv6 and segment routing. Sysadmins of hosts that do not use nft_inner expressions at all are not exposed and need only routine patching.

Affected VersionsENISA

Linux patch: 7.1-rc5
Linux patch: 7.0.11
Linux patch: 6.6.142
Linux 3a07327d10a09379315c844c63f27941f5081e0a <c161ad9157f5a0429b5ff94d9770faf3bf48d273
Linux 3a07327d10a09379315c844c63f27941f5081e0a <b6a91f68ebfed9c38e0e9150f58a9b85da07181c
Linux 3a07327d10a09379315c844c63f27941f5081e0a <689bbf48c1f45130086ae1c46ab83ea4c753c601
Linux patch: 6.18.34
Linux patch: 0
Linux 6.2
Linux 3a07327d10a09379315c844c63f27941f5081e0a <870d59e2cf218e7418491e26bad768cb16654582
Linux patch: 6.12.92
Linux 3a07327d10a09379315c844c63f27941f5081e0a <d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in net/netfilter/nft_inner.c, specifically the nft_inner_parse_l2l3() function, which inspects the inner network/transport headers of tunneled traffic so nftables rules can match on encapsulated payloads. For inner IPv6, the code correctly calls ipv6_find_hdr() to walk all IPv6 extension headers (Hop-by-Hop, Routing, Fragment, Destination Options, etc.) and return the true offset of the transport header, but immediately overwrites that offset with nhoff + sizeof(struct ipv6hdr) - a flat 40-byte assumption that ignores any extension headers present. The result is that inner_thoff points to the first extension header while l4proto still reflects the real transport protocol (e.g., IPPROTO_TCP) discovered by ipv6_find_hdr(), creating an inconsistent parse state that downstream rule evaluation trusts. The non-inner IPv6 path in netfilter does not have this defect, making it a regression localized to inner/tunneled parsing introduced when nft_inner support landed in 6.2. No CWE was assigned in the input, but the root cause class is incorrect calculation/parsing of protocol header offsets leading to security-decision-relevant state mismatch.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.3 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
CVSS changed
Jun 05, 2026 - 07:22 NVD
9.1 (CRITICAL)
Patch available
Jun 03, 2026 - 19:01 EUVD
CVE Published
Jun 03, 2026 - 15:48 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 03, 2026 - 15:48 nvd
CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: Fix IPv6 inner_thoff desync

In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong - points to extension header start) and l4proto (correct - e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2.

For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

Executive ViewAI

Why It Matters

A CRITICAL firewall bypass in the Linux kernel netfilter module (CVE-2026-46244) allows attackers to circumvent nftables security rules on IPv6 networks through packet header manipulation. Although no public exploit has been identified at this time, organizations relying on Linux-based network segmentation and firewall controls must patch immediately, as this vulnerability directly undermines a primary security boundary with a CVSS score of 9.1.

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-823 – Use of Out-of-range Pointer Offset

View all
CVE-2016-2161 HIGH
7.5
CVE-2022-0729 HIGH POC
8.8
CVE-2026-41907 HIGH POC
8.1
CVE-2021-3889 HIGH POC
8.1
CVE-2021-3888 HIGH POC
8.1
CVE-2022-0685 HIGH POC
7.8
CVE-2020-6112 HIGH POC
7.8
CVE-2024-42383 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46244 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/368185 REF https://access.redhat.com/errata/RHSA-2026:33215 REF https://access.redhat.com/errata/RHSA-2026:34094 REF https://access.redhat.com/errata/RHSA-2026:34443 REF https://access.redhat.com/errata/RHSA-2026:34911 REF https://access.redhat.com/errata/RHSA-2026:36018 REF https://access.redhat.com/errata/RHSA-2026:55618 REF https://access.redhat.com/errata/RHSA-2026:55763 REF https://access.redhat.com/errata/RHSA-2026:56225 REF https://access.redhat.com/security/cve/CVE-2026-46244 REF https://bugzilla.redhat.com/show_bug.cgi?id=2484451 REF https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601 REF https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582 REF https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c REF https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273 REF https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46244.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy