CVE-2026-23397

A flaw was found in the nfnetlink_osf module of the Linux kernel. A remote attacker could send specially crafted network packets containing malformed options, such as zero-length options or a Maximum Segment Size (MSS) option with an invalid length. This could lead to a system crash, resulting in a Denial of Service (DoS), which makes the system unavailable to legitimate users.

Exploitation of this vulnerability requires CAP_NET_ADMIN privileges to load the malicious OS fingerprint via nfnl_osf_add_callback(). Network packets then trigger the crash during fingerprint matching. Since setting up the vulnerable condition requires elevated privileges, and the impact is limited to denial of service, the risk is reduced compared to a purely remote attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nfnetlink_osf and xt_osf modules from being loaded. See https://access.redhat.com/solutions/41278 for instructions.