Bug 2484451 (CVE-2026-46244)

Summary: CVE-2026-46244 kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nft_inner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset (inner_thoff) becomes desynchronized from the Layer 4 protocol (l4proto). A remote attacker could exploit this desynchronization to perform transport header forgery, potentially leading to a firewall bypass and allowing unauthorized network access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-03 18:02:06 UTC 
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: Fix IPv6 inner_thoff desync

In nft_inner_parse_l2l3(), when processing inner IPv6 packets,
ipv6_find_hdr() correctly computes the transport header offset
traversing all extension headers, but the result is immediately
overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only
accounts for the IPv6 base header. This creates a desync between
inner_thoff (wrong — points to extension header start) and l4proto
(correct — e.g., IPPROTO_TCP), enabling transport header forgery
and potential firewall bypass. This issue affects stable versions
from Linux 6.2.

For comparison, the normal (non-inner) IPv6 path correctly
preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite
ensures that ipv6_find_hdr()'s calculated transport header offset is
preserved, thereby fixing the desynchronization.
Comment 1 Keith Grant 2026-06-03 19:45:33 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026060309-CVE-2026-46244-e8d7@gregkh/T
Comment 5 errata-xmlrpc 2026-06-29 19:24:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:33215 https://access.redhat.com/errata/RHSA-2026:33215
Comment 6 errata-xmlrpc 2026-07-01 08:59:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:34094 https://access.redhat.com/errata/RHSA-2026:34094
Comment 7 errata-xmlrpc 2026-07-01 19:15:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:34443 https://access.redhat.com/errata/RHSA-2026:34443
Comment 8 errata-xmlrpc 2026-07-02 13:42:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:34911 https://access.redhat.com/errata/RHSA-2026:34911
Comment 9 errata-xmlrpc 2026-07-06 19:57:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:36018 https://access.redhat.com/errata/RHSA-2026:36018