CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's netfilter subsystem, specifically in the nfnetlink_osf component responsible for OS fingerprinting via TCP option matching. The flaw is reachable over the network without any authentication, allowing a remote attacker to send crafted packets that trigger the buggy code path. Successful exploitation enables the attacker to read arbitrary kernel memory (confidentiality impact) and cause a denial of service by crashing the affected system (availability impact). Patched-image rebuilds at the fix commits are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network; an attacker must be able to send TCP packets to the target system to trigger option parsing in nf_osf_match_one().

• AuthenticationNot required

  No credentials or session token are needed; the attacker sends unauthenticated packets to reach the vulnerable netfilter hook.

• Victim interactionNot required

  No user action is required; exploitation is fully remote and passive from the victim's perspective.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions such as race conditions or knowledge of memory layout.

Blast Radius

• A successful attacker reads arbitrary kernel memory contents, which may include cryptographic keys, session tokens, or other sensitive in-memory data.
• The out-of-bounds read can destabilize kernel state and crash the host system, taking down all containers and workloads running on that node.
• Because the affected component is in the netfilter path, any host with OS fingerprinting rules active and network exposure is within scope regardless of the containerized workloads it runs.
• Data read from kernel memory could be used to defeat address-space layout randomization, enabling follow-on exploitation of separate vulnerabilities.