CVE-2026-52998

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential NULL dereference exists in the nf osf ttl() function within the netfilter nfnetlink osf module. The function accessed skb->dev to perform a local interface address lookup without verifying if the device pointer was valid. Furthermore, the use of an in dev for each ifa rcu loop to match packet source addresses against local interface addresses incorrectly assumed that packets from the same subnet should not experience a decrement on the initial TTL, which is inaccurate in environments utilizing containers and virtual switching.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.