CVE-2026-45841

A flaw was found in the Linux kernel's netfilter component. A local attacker with CAP_NET_ADMIN capabilities, which grants certain network administration privileges, could trigger a divide-by-zero error by adding a specially crafted fingerprint via nfnetlink. This vulnerability could lead to a kernel panic, effectively causing a Denial of Service (DoS) on the affected system.

nfnetlink_osf accepts an invalid OS fingerprint where OSF_WSS_MODULO is selected with a zero WSS value. When a later matching TCP SYN is processed, nf_osf_match_one computes the TCP window modulo that value and triggers a divide by zero in the kernel. For the CVSS the PR:L is used for the paranoid score because CAP_NET_ADMIN can be delegated to container root, reduced capability root, or a firewall management service account in some deployments. The bug is not a memory corruption primitive and does not indicate direct confidentiality or integrity impact. Impact is denial of service via kernel panic. The final crash can be triggered by packet processing after the bad fingerprint is installed, but practical exploitation still depends on access to the netfilter OSF control plane.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.