CVE-2026-52999

A flaw was found in the Linux kernel's netfilter subsystem, specifically in the nfnetlink_osf module. When the NF_OSF_LOGLEVEL_ALL option is configured, an out-of-bounds read vulnerability can occur during TCP option parsing. This issue can lead to incorrect data processing and logging failures, potentially causing a denial of service by hindering the system's ability to accurately filter and monitor network traffic.

This vulnerability is rated as a Moderate impact for Red Hat Enterprise Linux because exploitation requires a non-default Netfilter configuration utilizing passive OS fingerprinting with exhaustive logging enabled. In standard deployments, OS fingerprint matching is not enabled, limiting the attack surface to specialized firewall rulesets. While processing crafted TCP packets under these conditions causes out-of-bounds reads that disrupt network traffic classification, the flaw does not facilitate arbitrary code execution or compromise host integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.