CVE-2026-97417

netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

HIGH

7.5

CVSS Score

Published: September 24, 2026 at 04:03 PM UTC

Updated: October 3, 2026 at 11:17 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.5%

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped. This matches the existing get_unaligned_be32() use later in the same function.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.1 ≤ v < 5.10.2713.1 ≤ v < 5.15.2223.1 ≤ v < 6.1.1893.1 ≤ v < 6.12.1113.1 ≤ v < 6.18.533.1 ≤ v < 6.6.1583.1 ≤ v < 7.23.1bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9

Vendor states this is fixed in 0d5ad732e4fdc569eb85861115e8f7b4c2c67852 (fixed)

Vendor states this is fixed in 4abc1af7ac209c066f4e5dd75cdd56876e5829a9 (fixed)

Vendor states this is fixed in 55bcc3376cd7b18954cc9814da697504fdaf12bf (fixed)

Vendor states this is fixed in 740ad3d17a281f7764dda4dbeb37cea52e2e31ae (fixed)

Vendor states this is fixed in 7ecfa46a536578a7ed335ddf31a854127268c27c (fixed)

Vendor states this is fixed in a0523267de2523522b0f70972dd1ffa22ec6176c (fixed)

Vendor states this is fixed in d3bf9eae486490832bd08fd62ab0ac601f346bd4 (fixed)

Vendor states this is fixed in 3.1 (unaffected)

Vendor states this is fixed in 5.10.271 (unaffected)

Vendor states this is fixed in 5.15.222 (unaffected)

Vendor states this is fixed in 6.1.189 (unaffected)

Vendor states this is fixed in 6.12.111 (unaffected)