CVE-2026-45841 - Vulnerability Details

- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

nf_osf_match_one() computes ctx->window % f->wss.val in the
OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A
CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a
subsequent matching TCP SYN divides by zero and panics the kernel.

Reject the bogus fingerprint in nfnl_osf_add_callback() above the
per-option for-loop. f->wss is per-fingerprint, not per-option, so
the check must run regardless of f->opt_num (including 0). Also
reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that
as "should not happen".

Crash:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
Call Trace:
<IRQ>
nf_osf_match (net/netfilter/nfnetlink_osf.c:220)
xt_osf_match_packet (net/netfilter/xt_osf.c:32)
ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
nf_hook_slow (net/netfilter/core.c:622)
ip_local_deliver (net/ipv4/ip_input.c:265)
ip_rcv (include/linux/skbuff.h:1162)
__netif_receive_skb_one_core (net/core/dev.c:6181)
process_backlog (net/core/dev.c:6642)
__napi_poll (net/core/dev.c:7710)
net_rx_action (net/core/dev.c:7945)
handle_softirqs (kernel/softirq.c:622)

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A divide‑by‑zero error in the nfnetlink_osf module occurs when nf_osf_match_one() calculates ctx->window % f->wss.val without first verifying that f->wss.val is non‑zero. A user with CAP_NET_ADMIN can add a fingerprint that causes this calculation and triggers a kernel panic on the next matching TCP SYN. This results in a system‑wide denial of service. The weakness is a classic divide‑by‑zero error leading to unintended crash.

Affected Systems

All Linux kernel builds that include the nfnetlink_osf implementation and have not yet incorporated the patch introducing a guard against zero‑modulus values. The affected code lives in net/netfilter/nfnetlink_osf.c and is part of the core kernel, so any distribution kernel containing that source file is susceptible.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity, but the vulnerability still leads to a kernel crash, which is a serious denial of service. The EPSS score of less than 1% indicates a very low probability of exploitation and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires CAP_NET_ADMIN, which is typically only present for privileged users or services. Therefore the risk is high for systems where local or remote privilege escalation is possible, and moderate otherwise. A patch is the most effective mitigation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< cb833bbc1b3c51e08652d3c86298307c07d3f2db
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< 26900306a5a2c3e4f75c643a064525526bb6e5f3
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< 0694618cf3e9b120666e31f5f383a6e466d95a0d
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< 8def8fbd23f40e945febe913d04b731012ce0082
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< c55940895245d8ef658ab381248a28755218d625
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< 9a05e195618a6d474f2bcd5b6376d0ffc2f00366
`11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384`	affected	< 2195574dc6d9017d32ac346987e12659f931d932

Linux

affected

Version	Status	Constraints
`2.6.31`	affected	—
`0`	unaffected	< 2.6.31
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384,8def8fbd23f40e945febe913d04b731012ce0082)`	affected	code_commit	—
`[11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384,c55940895245d8ef658ab381248a28755218d625)`	affected	code_commit	—
`[11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384,fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f)`	affected	code_commit	—
`[11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384,9a05e195618a6d474f2bcd5b6376d0ffc2f00366)`	affected	code_commit	—
`[11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384,2195574dc6d9017d32ac346987e12659f931d932)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.31`	affected	semver	—
`[0,2.6.31)`	unaffected	semver	—
`[6.6.141,6.6.*]`	unaffected	generic	—
`[6.12.91,6.12.*]`	unaffected	generic	—
`[6.18.33,6.18.*]`	unaffected	generic	—
`[7.0.10,7.0.*]`	unaffected	generic	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the commit fixing the divide‑by‑zero check (e.g., any release after the linked patch commit).
If the kernel cannot be upgraded immediately, restrict the CAP_NET_ADMIN capability for processes that interact with nfnetlink or disable nfnetlink_osf functionality entirely to prevent the addition of malicious fingerprints.
As a temporary workaround, manually ensure that any fingerprints added via nfnetlink have a non‑zero wss.val and that wss.wc is less than OSF_WSS_MAX, though this still relies on correct input validation by administrators.

Generated by OpenCVE AI on May 28, 2026 at 04:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0694618cf3e9b120666e31f5f383a6e466d95a0d
https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932
https://git.kernel.org/stable/c/26900306a5a2c3e4f75c643a064525526bb6e5f3
https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082
https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366
https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625
https://git.kernel.org/stable/c/cb833bbc1b3c51e08652d3c86298307c07d3f2db
https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f
https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45841-9575@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45841
https://www.cve.org/CVERecord?id=CVE-2026-45841

History

Mon, 01 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0694618cf3e9b120666e31f5f383a6e466d95a0d https://git.kernel.org/stable/c/26900306a5a2c3e4f75c643a064525526bb6e5f3 https://git.kernel.org/stable/c/cb833bbc1b3c51e08652d3c86298307c07d3f2db

Thu, 28 May 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-190

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45841-9575@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45841 https://www.cve.org/CVERecord?id=CVE-2026-45841
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 27 May 2026 12:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190 CWE-369

Wed, 27 May 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO nf_osf_match_one() computes ctx->window % f->wss.val in the OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a subsequent matching TCP SYN divides by zero and panics the kernel. Reject the bogus fingerprint in nfnl_osf_add_callback() above the per-option for-loop. f->wss is per-fingerprint, not per-option, so the check must run regardless of f->opt_num (including 0). Also reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that as "should not happen". Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: <IRQ> nf_osf_match (net/netfilter/nfnetlink_osf.c:220) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:348) nf_hook_slow (net/netfilter/core.c:622) ip_local_deliver (net/ipv4/ip_input.c:265) ip_rcv (include/linux/skbuff.h:1162) __netif_receive_skb_one_core (net/core/dev.c:6181) process_backlog (net/core/dev.c:6642) __napi_poll (net/core/dev.c:7710) net_rx_action (net/core/dev.c:7945) handle_softirqs (kernel/softirq.c:622)
Title		netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932 https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082 https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366 https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625 https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T09:24:40.805Z

Updated: 2026-06-14T17:46:14.099Z

Reserved: 2026-05-13T15:03:33.078Z

Link: CVE-2026-45841

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-27T11:16:23.493

Modified: 2026-06-01T17:17:14.157

Link: CVE-2026-45841

Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45841 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T04:45:07Z

Weaknesses

CWE-369
Divide By Zero

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object