CVE-2026-46244

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.2 and later

Description A desynchronization issue exists in the nft inner parse l2l3() function when processing inner IPv6 packets. While the ipv6 find hdr() function correctly calculates the transport header offset by traversing extension headers, this value is incorrectly overwritten by a calculation that only accounts for the IPv6 base header. This results in a mismatch between inner thoff, which incorrectly points to the start of the extension header, and l4proto, which correctly identifies the protocol (e.g., IPPROTO TCP). This discrepancy allows for transport header forgery and potential firewall bypass.

Recommendations Update to a version where the incorrect overwrite in the nft inner parse l2l3() function has been removed to ensure the transport header offset is preserved.