SB20260528211 - Always-Incorrect Control Flow Implementation in Linux kernel netfilter

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-45859)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state handling in nfnetlink_queue when processing UDP GSO packets with an unconfirmed nf_conn entry. A remote attacker can send specially crafted network traffic to cause a denial of service.

The issue occurs when an application has not enabled the F_GSO capability flag.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/207b3ebacb6113acaaec0d171d5307032c690004
• https://git.kernel.org/stable/c/23901aa6b8a2f294c4b774436b4691f3ff863a8f
• https://git.kernel.org/stable/c/79b713ef4261a8ead96af4703f89d0b5f25532e2
• https://git.kernel.org/stable/c/b740e7ddd7ca0dbfeafca3f5e52717206cf28524