CVE-2026-97417: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-97417 is a memory alignment vulnerability in the Linux kernel's netfilter nf_conntrack subsystem, specifically within the tcp_sack() function's timestamp-only fast path. The flaw arises from dereferencing the TCP option stream as a 4-byte aligned pointer (*(__be32 *)ptr) without guaranteeing the required alignment, which the TCP option stream does not provide. It affects Linux kernel versions from 3.1 up to (but not including) 6.12.111 and 6.18.53, with fixes available in those stable releases and kernel 7.2+. It was published on September 24, 2026, with a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-843 (Access of Resource Using Incompatible Type / 'Type Confusion'): the tcp_sack() function in net/netfilter/nf_conntrack_proto_tcp.c casts the TCP option byte stream pointer directly to __be32 * and dereferences it, implicitly assuming 4-byte alignment that the TCP protocol does not guarantee for option fields. On architectures that enforce strict alignment (e.g., ARM, MIPS), this unaligned access can trigger a bus error or kernel panic; on x86 it may silently read incorrect data. The fix replaces the unsafe cast with get_unaligned_be32(), which performs a safe byte-by-byte read regardless of alignment and returns the value in host byte order, eliminating the need for the htonl() on the comparison constant. No public proof-of-concept exploit code is known at this time (Github Advisory, Feedly).

Successful exploitation allows an unauthenticated remote attacker to send specially crafted TCP packets with misaligned option data, triggering an unaligned memory read in the kernel's netfilter connection tracking code. On strict-alignment architectures this can cause a kernel panic (denial of service), while on other architectures it may result in disclosure of sensitive kernel memory contents. The availability impact is rated High with no confidentiality or integrity impact per the CVSS scoring, though the Feedly executive summary notes potential kernel memory disclosure as a secondary risk (Github Advisory, Feedly).

There is no evidence of active in-the-wild exploitation or a public proof-of-concept at this time (Feedly). The vulnerability is remotely exploitable with no authentication or user interaction required (network-accessible, low complexity), making it theoretically attractive to attackers. The EPSS score is approximately 0.426%, indicating a low current probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin 350043 is available for identifying vulnerable systems (Tenable).

Update the Linux kernel to version 6.12.111, 6.18.53, or later (kernel 7.2+ is also unaffected). The fix is delivered via commits 4abc1af7ac209c066f4e5dd75cdd56876e5829a9 (stable/6.12), 7ecfa46a536578a7ed335ddf31a854127268c27c (stable/6.18), and d3bf9eae486490832bd08fd62ab0ac601f346bd4. Distribution-specific kernel updates from vendors such as Red Hat should be applied according to your organization's patch management procedures. No configuration-based workaround is known; patching is the only remediation (Github Advisory, Red Hat).

Red Hat has acknowledged the vulnerability and published a security advisory tracking it via Bugzilla (Red Hat). The GitHub Advisory Database has classified it as High severity and published the advisory on September 24, 2026 (Github Advisory). No notable independent researcher commentary or significant social media discussion beyond automated CVE tracking feeds has been observed.