All vulnerabilities
CVE-2026-97417

Linux: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 41% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in740ad3d17a281f7764dda4dbeb37cea52e2e31aeAlso 55bcc3376cd7b18954cc9814da697504fdaf12bf, 0d5ad732e4fdc569eb85861115e8f7b4c2c67852 and 2 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 740ad3d17a281f7764dda4dbeb37cea52e2e31aeLinuxCVE List
  • 55bcc3376cd7b18954cc9814da697504fdaf12bfLinuxCVE List
  • 0d5ad732e4fdc569eb85861115e8f7b4c2c67852LinuxCVE List
  • 7ecfa46a536578a7ed335ddf31a854127268c27cLinuxCVE List
  • 4abc1af7ac209c066f4e5dd75cdd56876e5829a9LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped.

This matches the existing get_unaligned_be32() use later in the same function.

Text from CVE List

Affected versions 16

  • Linuxaffected: bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 before 740ad3d17a281f7764dda4dbeb37cea52e2e31aeCVE List
  • Linuxaffected: bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 before a0523267de2523522b0f70972dd1ffa22ec6176cCVE List
  • Linuxaffected: bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 before 55bcc3376cd7b18954cc9814da697504fdaf12bfCVE List
  • Linuxaffected: bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 before 0d5ad732e4fdc569eb85861115e8f7b4c2c67852CVE List
  • Linuxaffected: bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 before 7ecfa46a536578a7ed335ddf31a854127268c27cCVE List
  • Linuxaffected: bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 before 4abc1af7ac209c066f4e5dd75cdd56876e5829a9CVE List
  • Linuxaffected: bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 before d3bf9eae486490832bd08fd62ab0ac601f346bd4CVE List
  • Linuxaffected: 3.1CVE List
  • Linuxunaffected: all versions before 3.1CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7