Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-52999

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each fingerprint checked. During TCP option parsing, nf_osf_match_one() advances the shared ctx->optp pointer. If a fingerprint perfectly matches, the function returns early without restoring ctx->optp to its initial state. If the user has con
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f27ffa2e805163a5eb7fd2d0641166cee1ef6e4a3515fd04c242188fa294948b
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nfnetlink_osf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"l…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nfnetlink_osf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0145548346c4a30981a870a8ca00eac46ba27e85","status":"affected","version":"1a6a0951fc009f6d9fe8ebea2d2417d80d54097b","versionType":"git"},{"lessThan":"1c136f2c44a5913646bac85303612fd0825197a0","status":"affected","version":"1a6a0951fc009f6d9fe8ebea2d2417d80d54097b","versionType":"git"},{"lessThan":"1e19a07291bb8682c14c39a64725a3ae54ab8ccc","status":"affected","version":"1a6a0951fc009f6d…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nfnetlink_osf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"l…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nfnetlink_osf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0145548346c4a30981a870a8ca00eac46ba27e85","status":"affected","version":"1a6a0951fc009f6d9fe8ebea2d2417d80d54097b","versionType":"git"},{"lessThan":"1c136f2c44a5913646bac85303612fd0825197a0","status":"affected","version":"1a6a0951fc009f6d9fe8ebea2d2417d80d54097b","versionType":"git"},{"lessThan":"1e19a07291bb8682c14c39a64725a3ae54ab8ccc","status":"affected","version":"1a6a0951fc009f6d…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/0145548346c4a30981a870a8ca00eac46ba27e85"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/1c136f2c44a5913646bac85303612fd0825197a0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/1e19a07291bb8682c14c39a64725a3ae54ab8ccc"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/21883587593d7c8bb519a79460a0b5bc5ffbdabd"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/32e50f92c7cf3f4eba29622179a5fcdc2aebab41"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/70a3f31d25cf2ec9d4ddfa408120171ead955623"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/edb78a142d2e5948e63647c0646aa7e7886935f0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/f5ca450087c3baf3651055e7a6de92600f827af3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6d9f60e2bbf81836c88ffe2feaf60b9415c602009e74a8d81da73909d6e52e9 · sha256:73767442a8fca387… · /containers/cna/references/7

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer