Look up another CVE · open CVE-2026-52915 in the interactive tracker

CVE-2026-52915

netfilter: ip6t_hbh: reject oversized option lists

7.1 EPSS 0.1% AV:L

Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem net/ipv6. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-52915 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4665-1 · 2026-07-03 · text	6.1.176-1	Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.94-1	Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.0.12-1	Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.12-1	Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace. Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged. `struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array, where `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible: [ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]'

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/ipv6/netfilter/ip6t_hbh.c

What this is: NETFILTERMAINTAINERS section matched on net/*/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
Kernel module: ip6t_hbh

Check it on the machine

grep -wE 'CONFIG_IP6_NF_MATCH_OPTS|CONFIG_NETFILTER' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ip6t_hbh

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switches: CONFIG_IP6_NF_MATCH_OPTS, CONFIG_NETFILTER
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-06-24 (4 months ago)source
CVSS: 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.13%, higher than 2.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/ipv6

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.12	5.10.258	2d523ba48d4e
2.6.12	5.15.209	588933f1a2ca
2.6.12	6.1.175	784aadea7a10
2.6.12	6.6.142	41ec2e242f17
2.6.12	6.12.92	db0250470f02
2.6.12	6.18.34	57b0ac5e1b46
2.6.12	7.0.11	6feb43c0995a
2.6.12	7.1	4322dcde6b41

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4671-1	2026-07-05	bullseye 6.1.176-1~deb11u1	tracker
DLA-4665-1	2026-07-03	bookworm 6.1.176-1	tracker
DLA-4664-1	2026-07-03	bullseye 5.10.259-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The attacker must locally install a malformed IPv6 xtables/nft_compat hbh or dst match rule; the later packet evaluation can be driven by traffic, but the vulnerable state is created through local netfilter control interfaces.
AC:LAttack complexity, low: No race or rare external condition is required: the attacker supplies optsnr > 16 and then causes matching IPv6 extension-header traffic to be evaluated.
PR:LPrivileges required, low: Rule installation requires CAP_NET_ADMIN in the target network namespace, and netfilter configuration is reachable by an unprivileged local user via a user+network namespace on systems allowing user namespaces.
UI:NUser interaction, none: Once the attacker has local access and required namespace capability, no victim action is needed to install the malformed rule or trigger packet evaluation.
S:UScope, unchanged: The impact remains within the kernel/network namespace security authority; this is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.
C:HConfidentiality impact, high: The oversized optsnr causes out-of-bounds reads past the fixed opts[16] array into adjacent kernel memory, and repeated attacker-controlled packet comparisons can serve as a kernel-memory disclosure oracle.
I:NIntegrity impact, none: The vulnerable code only reads out-of-bounds values and compares them with packet option bytes; it does not provide an out-of-bounds write or direct data modification primitive.
A:HAvailability impact, high: The out-of-bounds array access can run past the installed match object during packet evaluation and was observed by UBSAN; in hardened or unlucky memory layouts this can produce an oops/panic.