CVE-2026-97417

A flaw was found in the Linux kernel's netfilter connection tracking subsystem. The TCP option processing mechanism improperly assumes memory alignment when reading packet headers. A remote attacker could exploit this vulnerability by sending crafted TCP packets with misaligned SACK options through a system running conntrack (e.g., Linux firewall/NAT using iptables/nftables), causing a memory access fault that leads to a kernel panic and Denial of Service (DoS).

This vulnerability is rated as having an Important severity because an unauthenticated remote attacker can trigger an immediate denial of service (system crash) without requiring user interaction or elevated privileges. Systems configured to route or filter network traffic using stateful firewalling, Network Address Translation (NAT), or container routing stacks such as OpenShift are directly exposed to unaligned TCP packets traversing the connection tracking engine. While the defect can disrupt host availability through an unaligned memory access fault during TCP selective acknowledgment inspection, it cannot be leveraged to compromise confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Systems that do not require stateful firewall, NAT, or connection tracking can eliminate exposure by unloading the nf_conntrack kernel module. On systems where conntrack is required, exposure can be reduced by applying NOTRACK rules in the raw table to bypass connection tracking on untrusted or internet-facing interfaces, ensuring the vulnerable TCP SACK parsing code path in tcp_sack() is not reached for attacker-controlled traffic.