CVE-2026-52999: Linux kernel netfilter nfnetlink_osf out-of-bounds read in TCP option matching
The Linux kernel netfilter component nfnetlink_osf has an out-of-bounds read (CWE-125) during TCP option matching for OS fingerprints. A shared parsing pointer was not restored between fingerprint checks, so later checks could read invalid data and fail. The CNA-supplied CVSS 3.1 score is 9.1 (critical), and the record lists no KEV entry or confirmed exploitation.
Overview
The record describes a flaw in the Linux kernel netfilter component nfnetlink_osf, which matches TCP options against OS fingerprints. A shared parsing pointer is advanced during one fingerprint check and is not reset before the next check, which causes an out-of-bounds read classified as CWE-125. The upstream fix makes the parsing pointer local to each traversal.
Impact
The CNA's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) rates the issue as network-reachable, low complexity, requiring no privileges or user interaction, with high confidentiality and availability impact and no integrity impact. The score of 9.1 is the only score in the record. The description itself reports garbage data reads and failed or incorrect logging of matches; it does not describe a specific crash or data disclosure outcome, so the concrete effect in practice is unknown from the available data.
Affected products and versions
The record lists the product as Linux Linux Kernel with these ranges and versions:
- From 4.19.26 before 4.20
- From 4.20.13 before 5.0
- From 5.0.1 before 5.10.258
- From 5.11 before 5.15.209
- From 5.16 before 6.1.175
- From 6.2 before 6.6.141
- From 6.7 before 6.12.91
- From 6.13 before 6.18.33
- From 6.19 before 7.0.10
- Version 5.0, and release candidates 5.0-rc5, 5.0-rc6, 5.0-rc7 and 5.0-rc8
The record does not state explicit fixed versions. The upper bounds of the ranges suggest the corrected stable releases, but this is an inference and administrators should confirm against the commits and their vendor or distribution builds.
Exploitation status
The record shows no KEV listing, and no EPSS data is available. No confirmed active exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Update to a stable kernel release that includes the upstream commits listed in the references, choosing the stable branch that matches your kernel series.
- Check whether your distribution or device vendor has released a kernel that backports these commits, since vendor builds may use different version numbers.
- The record references a Siemens product security advisory, but its content is not included in the record; consult it if you use affected Siemens products.
- The record does not document a workaround. If the OS fingerprint matching feature is not needed, reducing its use is a general hardening measure, not a verified mitigation for this issue.
Detection guidance
- Inventory systems running kernels within the affected ranges and compare them with vendor advisories.
- Determine whether the nfnetlink_osf functionality is in use on firewall or gateway systems, since the issue is in that code path.
- Review logs of OS fingerprint matches for missing, repeated or inconsistent entries, which may reflect the logging problem described in the record. This is an inference from the description, not a confirmed indicator of compromise.
Limitations of the available information
The record provides no proof-of-concept details, no exploitation data, no EPSS score and no KEV entry. It gives no explicit fixed version numbers, and the NVD analysis is not included. The title was missing from the source record and was written for this portal. The concrete security consequences beyond the CVSS vector are unknown.
Frequently asked questions
What kind of vulnerability is CVE-2026-52999?
It is an out-of-bounds read (CWE-125) in the Linux kernel netfilter component nfnetlink_osf, caused by a shared parsing pointer that is not restored between OS fingerprint checks.
Is this CVE known to be actively exploited?
No. The record shows no KEV listing, and no confirmed active exploitation appears in the sources consulted.
How should administrators respond?
Update to a stable kernel or vendor build that includes the upstream commits listed in the references, and confirm the fix against your distribution's advisories since no explicit fixed versions are stated in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.