Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2026-46244

netfilter: nft_inner: Fix IPv6 inner_thoff desync
Back to all
CVE

CVE-2026-46244

netfilter: nft_inner: Fix IPv6 inner_thoff desync

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftinner: Fix IPv6 innerthoff desync

In nftinnerparse_l2l3(), when processing inner IPv6 packets,

ipv6findhdr() correctly computes the transport header offset

traversing all extension headers, but the result is immediately

overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only

accounts for the IPv6 base header. This creates a desync between

inner_thoff (wrong — points to extension header start) and l4proto

(correct — e.g., IPPROTO_TCP), enabling transport header forgery

and potential firewall bypass. This issue affects stable versions

from Linux 6.2.

For comparison, the normal (non-inner) IPv6 path correctly

preserves ipv6findhdr()'s result. Removing the incorrect overwrite

ensures that ipv6findhdr()'s calculated transport header offset is

preserved, thereby fixing the desynchronization.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
-

Related Resources

No items found.

References

https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601, https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582, https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c, https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273, https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce, https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46244.json, https://access.redhat.com/errata/RHSA-2026:33215, https://access.redhat.com/errata/RHSA-2026:34094, https://access.redhat.com/errata/RHSA-2026:34443, https://access.redhat.com/errata/RHSA-2026:34911, https://access.redhat.com/errata/RHSA-2026:36018, https://access.redhat.com/errata/RHSA-2026:55618, https://access.redhat.com/errata/RHSA-2026:55763, https://access.redhat.com/errata/RHSA-2026:56225, https://access.redhat.com/security/cve/CVE-2026-46244, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46244.json, https://nvd.nist.gov/vuln/detail/CVE-2026-46244, https://bugzilla.redhat.com/show_bug.cgi?id=2484451, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Severity

9.1

CVSS Score
0
10

Basic Information

Base CVSS
9.1
EPSS Probability
0.00322%
EPSS Percentile
0.25162%
Introduced Version
3a07327d10a09379315c844c63f27941f5081e0a,6.2.0,6.7.0,6.13.0,6.19.0,0
Fix Available
b6a91f68ebfed9c38e0e9150f58a9b85da07181c,6.6.142,6.12.92,6.18.34,7.0.11,0:5.14.0-687.22.1.el9_8,6.12.94-1,6.8.0-134.134,6.8.0-1060.63,6.17.0-1019.19~24.04.1,6.8.0-1063.71,6.17.0-1021.21~24.04.1,6.8.0-1062.69,6.8.0-1063.69,6.17.0-1020.22~24.04.1,6.8.0-1058.64,6.8.0-1045.48,6.17.0-40.40~24.04.1,7.0.0-28.28~24.04.1,6.8.0-1060.61,6.8.0-134.134.1,6.8.0-1058.61,6.17.0-1026.26,6.8.0-1058.61.1,6.8.0-1029.30,6.17.0-1028.28,6.8.0-1057.58,6.17.0-1018.18~24.04.1,6.8.0-1060.64,6.8.0-1032.33,6.8.0-1060.63~22.04.1,6.8.0-1063.71~22.04.1,6.8.0-1062.69~22.04.1,6.8.0-1063.69~22.04.1,6.8.0-136.136~22.04.1,6.8.0-1060.61~22.04.1,6.8.0-134.134.1~22.04.1,6.8.0-1058.61~22.04.1,6.8.0-1057.58~22.04.1,6.8.0-134.134~22.04.1,1:6.18.35-68.127.amzn2023,1:1.0-0.amzn2023,1:6.12.92-122.166.amzn2023

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading