CVE-2026-23397: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23397 is a null pointer dereference and out-of-bounds read vulnerability in the Linux kernel's nfnetlink_osf module (OS fingerprinting via netfilter). The flaw arises from insufficient validation of individual TCP option length fields in OS fingerprint entries, allowing a local attacker with low privileges to trigger kernel crashes or expose kernel memory. It was published on March 26, 2026, and affects Linux kernel versions from 2.6.31 through multiple stable branches up to 6.19.x and 7.0-rc releases. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The root cause (CWE-125: Out-of-bounds Read) lies in nfnl_osf_add_callback(), which validates opt_num bounds and string NUL-termination but does not check individual option length fields within fingerprint entries. Two distinct issues exist: (1) a zero-length option causes nf_osf_match_one() to enter the option-matching loop even when foptsize sums to zero, dereferencing a NULL ctx->optp pointer when matching packets with no TCP options, resulting in a general protection fault (KASAN null-ptr-deref); and (2) an MSS option (kind=2) with length < 4 causes out-of-bounds reads because the code unconditionally accesses optp[2] and optp[3] for MSS value extraction without bounds checking. The fix rejects fingerprints containing zero-length options or MSS options with length less than 4 at fingerprint addition time (Feedly).

A local attacker with low privileges can craft malicious OS fingerprint entries with malformed TCP options to trigger kernel crashes (denial of service via null pointer dereference or general protection fault), causing system instability and service interruption. Additionally, out-of-bounds reads in the MSS option handling path can expose kernel memory contents to privileged local processes, representing a confidentiality risk. The vulnerability's scope is limited to the local system (no network-based exploitation), but kernel crashes can affect all services running on the host (Feedly).

1. Gain local access: Obtain a low-privilege shell on a vulnerable Linux system running a kernel version between 2.6.31 and the unpatched stable releases (e.g., < 5.10.253, < 5.15.203, < 6.1.167, < 6.6.130, < 6.12.78, < 6.19.10).
2. Verify nfnetlink_osf availability: Confirm the nfnetlink_osf / xt_osf kernel module is loaded or loadable (e.g., lsmod | grep osf or attempt to load via modprobe xt_osf).
3. Craft malformed fingerprint entry: Use the nfnl_osf netlink interface (or a tool like p0f fingerprint loader) to add a fingerprint entry containing either a zero-length TCP option or an MSS option (kind=2) with a declared length less than 4 bytes.
4. Trigger matching: Send or receive a TCP packet that causes the netfilter OSF matching code (nf_osf_match_one) to evaluate the malformed fingerprint against incoming traffic — for the null-ptr-deref variant, a packet with no TCP options is sufficient.
5. Observe kernel crash or memory disclosure: The kernel will either crash with a general protection fault (null pointer dereference) causing a denial of service, or silently read out-of-bounds kernel memory during MSS value extraction (Feedly).

• Logs: Kernel oops/panic messages in /var/log/kern.log or dmesg output containing nf_osf_match_one in the call trace; KASAN reports referencing null-ptr-deref in range [0x0000000000000000-0x0000000000000007]; stack traces including xt_osf_match_packet, ipt_do_table, nf_hook_slow, ip_local_deliver.
• Process/System: Unexpected kernel crashes or system reboots on hosts with netfilter OSF rules active; dmesg entries showing general protection fault originating from net/netfilter/nfnetlink_osf.c:98.
• Network: Unusual netlink socket activity from low-privilege processes interacting with the nfnetlink_osf subsystem; unexpected loading of the xt_osf or nfnetlink_osf kernel module by non-root users.

Apply the patched kernel versions released for each stable branch: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and Azure Linux 3 kernel 6.6.126.1-1. Distribution-specific updates are available from Debian (linux 6.19.10-1, 6.12.85-1), Amazon Linux 2023 (ALAS2023-2026-1594, ALAS2023-2026-1681), Amazon Linux 2 (ALAS2KERNEL-5.15-2026-102), SUSE (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1), and openSUSE. As a workaround where patching is not immediately possible, restrict local user access and prevent untrusted users from loading kernel modules or manipulating netfilter rules (e.g., via CAP_NET_ADMIN restrictions). Network segmentation does not mitigate this vulnerability as it requires local access (Feedly).