What is the CVSS score of EUVD-2026-86030?

EUVD-2026-86030 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-86030?

Within 24 hours, identify all Linux systems running nf_conntrack on non-x86 architectures (e.g., ARM, MIPS, PowerPC, RISC-V) and apply the vendor-released kernel update that addresses CVE-2026-97417, consulting your distribution's security advisory for the exact patched version; if patching cannot be completed immediately, mitigate by disabling nf_conntrack on affected interfaces or filtering malformed TCP SACK options at the network perimeter. Within 7 days, verify that all firewalls, gateways, NAT hosts, and other conntrack-dependent systems have been patched, and monitor kernel logs for crash signatures. Within 30 days, update patch management policies to include kernel updates for network infrastructure on a regular cadence, and conduct a review to identify any remaining systems that may be vulnerable.

Linux Kernel EUVD-2026-86030

Q: Which versions of Linux Kernel are affected by EUVD-2026-86030?

A vulnerability in the Linux kernel's netfilter connection-tracking (nf_conntrack) component enables remote, unauthenticated attackers to crash systems on CPU architectures that do not tolerate…. A patch is available.

| CVE-2026-97417 HIGH

2026-09-24 Linux

GHSA-86rv-j9hx-pv73

Linux Red Hat Suse

7.5

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach conntrack-enabled host over network
Delivery

Send TCP packet with unaligned SACK option
Exploit

Trigger misaligned __be32 read in tcp_sack()
Execution

Alignment fault crashes kernel
Impact

Denial of service

Vulnerability Assessment

Exploitation Conditions	Requires the target to run netfilter connection tracking (nf_conntrack) processing TCP traffic - near-universal on firewalls/gateways/NAT hosts. The crash is triggered by TCP SACK options positioned at a non-4-byte-aligned offset in the option stream, which an attacker can craft. The critical LIMITING factor is CPU architecture: the fault occurs only on architectures that do not tolerate unaligned memory access; on x86/x86-64 the misaligned read is serviced transparently by hardware and does not crash, so those systems are effectively not exploitable. No authentication or user interaction is required (PR:N/UI:N) beyond network reachability to a conntrack-processing path.
Impact	The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) frames this as a remote, unauthenticated, availability-only issue - consistent with the description, which is a kernel crash (alignment fault), not information disclosure. However, the raw 7.5 overstates real-world risk: the bug is an unaligned 4-byte read ((__be32 )ptr) in the nf_conntrack TCP SACK fast path, and it only manifests as a fault on CPU architectures that trap unaligned accesses. On the dominant x86/x86-64 fleet unaligned reads are handled transparently in hardware, so those systems are effectively unaffected; the DoS is realistic mainly on stricter architectures (some ARM/MIPS/SPARC/PowerPC configurations). This makes effective attack complexity higher than AC:L implies. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or automated exploitation. Net: a legitimate hardening/robustness fix in a ubiquitous subsystem, but a lower operational priority than the 7.5 suggests for the typical x86 deployment. Note the 'Information Disclosure' tag conflicts with the vector's C:N/I:N/A:H - treat this as an availability/DoS issue, not a disclosure issue.
Exploit ScenarioDerived	A remote attacker sends crafted TCP segments carrying SACK options placed at an unaligned offset within the option stream to a host that performs stateful connection tracking (netfilter/nf_conntrack). On a kernel built for an architecture that faults on unaligned memory access, the tcp_sack() timestamp fast path dereferences the option as a misaligned __be32, triggering an alignment exception and a kernel crash (DoS). No public exploit code is identified at time of analysis, and x86/x86-64 targets are generally not impacted.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A malformed TCP SACK option stream can crash the Linux kernel on CPU architectures that do not tolerate unaligned memory access, because netfilter's nf_conntrack TCP option parser reads a 32-bit value through an unaligned pointer dereference in its timestamp fast path. The defect affects the kernel's connection-tracking code that processes TCP traffic, which runs on virtually every firewall, gateway, or NAT host that uses nf_conntrack, and it is exploitable by a remote, unauthenticated attacker who can reach a conntrack-processing path and craft SACK options at a non-4-byte-aligned offset (PR:N/UI:N), though the independent assessment rates this AC:H rather than AC:L because exploitation is limited to non-x86 alignment-faulting architectures. Impact is availability-only - a kernel fault/crash rather than memory corruption or disclosure - and no public exploit code was identified at time of analysis; the vendor fix is already available in stable releases.

RemediationAI

Vendor-released patch: upgrade to Linux 6.12.111, 6.18.53, or the mainline 7.2 release (respectively), which carry the switch from the raw *(__be32 *) cast to get_unaligned_be32() in nf_conntrack's tcp_sack(); the individual stable backports are at https://git.kernel.org/stable/c/7ecfa46a536578a7ed335ddf31a854127268c27c, https://git.kernel.org/stable/c/4abc1af7ac209c066f4e5dd75cdd56876e5829a9 and https://git.kernel.org/stable/c/d3bf9eae486490832bd08fd62ab0ac601f346bd4. No public exploit code was identified at time of analysis, and the fault only manifests on architectures that do not silently handle unaligned loads, so the most effective short-term compensating control is to run the affected network path on an alignment-tolerant platform (x86/x86-64), where the misaligned read is serviced by hardware and cannot crash the kernel - at the cost of leaving the defective code in place. Disabling connection tracking entirely (unloading nf_conntrack or avoiding the conntrack/netfilter hooks in the packet path) removes the attack surface but breaks stateful firewalling, NAT, and connection-based policy on gateways, so it is only viable in non-NAT deployments; alternatively, restricting which untrusted networks can deliver crafted TCP option-bearing traffic to a conntrack-processing host narrows exposure, though it does not fix the parsing flaw. Because the impact is denial of service rather than code execution or data disclosure, prioritize patching edge devices, CPEs, and NAT gateways built on non-x86 SoCs.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4abc1af7ac209c066f4e5dd75cdd56876e5829a9

Linux 0 <6.12.111

Linux patch: 6.18.53

Linux patch: 6.12.111

Linux 0 <6.18.53

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7ecfa46a536578a7ed335ddf31a854127268c27c

Linux patch: 7.2

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d3bf9eae486490832bd08fd62ab0ac601f346bd4

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerable code lives in the nf_conntrack TCP protocol handler (net/netfilter/nf_conntrack_proto_tcp.c), specifically the tcp_sack() parser that walks the TCP option stream looking for SACK and timestamp options. TCP options are a byte-granular, variable-length field: nothing in the protocol guarantees that an individual option payload (a 4-byte timestamp value, or SACK left/right edge values) begins at a 4-byte aligned address, yet the timestamp-only fast path type-punned the option pointer as *(__be32 *)ptr and dereferenced it directly. On strict-alignment architectures (many ARM/MIPS/PowerPC/RISC-V configurations, depending on kernel build) such an access raises an alignment fault that terminates the kernel, i.e. a denial-of-service condition. The fix replaces the raw cast with get_unaligned_be32(), which performs a safe byte-wise/hardware-assisted read and already yields host byte order, allowing the now-redundant htonl() on the comparison constant to be dropped - mirroring the same helper already used later in the function. The underlying root-cause class is unsafe type-punning/unaligned access (an incorrect cast dependency) rather than a buffer overflow: the parser does not mis-bound its reads, it simply assumes an alignment the protocol never provides. The CPE data (cpe:2.3:a:linux:linux) confirms the Linux kernel itself is the affected component, and the cited base commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 is the initial import of the kernel git history, meaning the misaligned read has been present since the code was introduced and only recently corrected.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 5.9 MEDIUM

Remote unauthenticated crafted packet (AV:N/PR:N/UI:N), but impact is gated on unaligned-access-intolerant architectures, so AC:H; crash-only availability impact (A:H), no C/I.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat 7.5 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Sep 25, 2026 - 05:23 NVD

7.5 (HIGH)

Patch available

Sep 24, 2026 - 17:03 EUVD

CVE Published

Sep 24, 2026 - 16:03 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 24, 2026 - 16:03 cve.org

HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped.

This matches the existing get_unaligned_be32() use later in the same function.

Executive ViewAI

Why It Matters

A vulnerability in the Linux kernel's netfilter connection-tracking (nf_conntrack) component enables remote, unauthenticated attackers to crash systems on CPU architectures that do not tolerate unaligned memory access, causing availability outages on firewalls, gateways, and NAT hosts. Organizations using such architectures for critical network infrastructure should prioritize patching because successful exploitation can disrupt network connectivity and services. No public exploit identified at time of analysis, and Patch available per vendor advisory.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 66% exploitable

Prevalence

Ubiquitous

netfilter/nf_conntrack is core to Linux stateful firewalling, present everywhere

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:75746 ADVISORY https://access.redhat.com/errata/RHSA-2026:75747 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97417 ADVISORY https://vuldb.com/vuln/409581 REF https://git.kernel.org/stable/c/0d5ad732e4fdc569eb85861115e8f7b4c2c67852 REF https://git.kernel.org/stable/c/4abc1af7ac209c066f4e5dd75cdd56876e5829a9 REF https://git.kernel.org/stable/c/55bcc3376cd7b18954cc9814da697504fdaf12bf REF https://git.kernel.org/stable/c/740ad3d17a281f7764dda4dbeb37cea52e2e31ae REF https://git.kernel.org/stable/c/7ecfa46a536578a7ed335ddf31a854127268c27c REF https://git.kernel.org/stable/c/a0523267de2523522b0f70972dd1ffa22ec6176c REF https://git.kernel.org/stable/c/d3bf9eae486490832bd08fd62ab0ac601f346bd4

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back