CVE-2026-46244

In the nft_inner_parse_l2l3() function processing internal IPv6 packets, the ipv6_find_hdr() function correctly calculates the transport header offset by traversing all extension headers. However, this result is immediately overwritten by the value nhoff + sizeof(_ip6h) (40 bytes), which accounts only for the basic IPv6 header. The consequence is desynchronization: the inner_thoff field incorrectly points to the beginning of extension headers, while l4proto contains the correct value (e.g., IPPROTO_TCP). This discrepancy allows crafting a packet that the netfilter engine will evaluate inconsistently with the actual structure of its headers.

A remote attacker without authentication can forge the transport header of an internal IPv6 packet, leading to bypassing firewall rules based on netfilter/nftables. The vulnerability results in unauthorized access to protected network resources (high confidentiality and integrity — no impact on availability).

Patches available from the vendor should be applied according to references (commits available in the kernel.org repository: 689bbf48c1f4, 870d59e2cf21, b6a91f68ebfe, c161ad9157f5, d0f98a3617f6). It is recommended to update the Linux kernel to a version containing the fix for the stable branch being used.

Stable Linux kernel versions from version 6.2 using the netfilter nft_inner module with support for internal IPv6 packets.