Critical 9.1Published Jun 3, 2026

CVE-2026-46244netfilter: nft_inner: Fix IPv6 inner_thoff desync

Updated under an hour ago (Oct 26, 2026, 5:10 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-823, CWE-682
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3a07327d10a09379315c844c63f27941f5081e0a before c161ad9157f5a0429b5ff94d9770faf3bf48d273; from 3a07327d10a09379315c844c63f27941f5081e0a before 870d59e2cf218e7418491e26bad768cb16654582; from 3a07327d10a09379315c844c63f27941f5081e0a before 689bbf48c1f45130086ae1c46ab83ea4c753c601; from 3a07327d10a09379315c844c63f27941f5081e0a before d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce; from 3a07327d10a09379315c844c63f27941f5081e0a before b6a91f68ebfed9c38e0e9150f58a9b85da07181c	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:6.12.0-211.30.1.el10_2 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus	from 0:6.12.0-55.84.1.el10_0 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions redhat:rhel_e4s	from 0:5.14.0-427.135.1.el9_4 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus	from 0:5.14.0-570.125.1.el9_6 not affected	CISA ADP
linux linux_kernel linux:linux_kernel	from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273	patch
https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582	patch
https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601	patch
https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce	patch
https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c	patch
https://access.redhat.com/errata/RHSA-2026:33215
https://access.redhat.com/errata/RHSA-2026:34094
https://access.redhat.com/errata/RHSA-2026:34443
https://access.redhat.com/errata/RHSA-2026:34911
https://access.redhat.com/errata/RHSA-2026:36018
1–10 of 16

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.