CVE-2026-52999

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the netfilter module. In the nf osf match() function, the nf osf hdr ctx structure is passed by reference to nf osf match one() for fingerprint checks. During TCP option parsing, nf osf match one() advances the shared ctx->optp pointer. If a fingerprint matches and NF OSF LOGLEVEL ALL is configured, the function returns early without restoring ctx->optp. Consequently, subsequent calls to nf osf match one() begin parsing from the end of the options buffer, leading to the reading of garbage data and incorrect match logging.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.