Look up another CVE · open CVE-2026-80637 in the interactive tracker
CVE-2026-80637
netfilter: synproxy: fix unaligned memory access in timestamp adjustment
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem net/netfilter. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80637 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory access or even a crash on strict alignment architectures. This follows the implementation of timestamp parsing in the networking stack at tcp_parse_options() and synproxy_parse_options().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/netfilter/nf_synproxy_core.c
- What this is
- NETFILTERMAINTAINERS section matched on net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
- Kernel module
- nf_synproxy_core
Check it on the machine
grep -wE 'CONFIG_NETFILTER|CONFIG_NETFILTER_SYNPROXY' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nf_synproxy_corePrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NETFILTER, CONFIG_NETFILTER_SYNPROXY
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.63%, higher than 49.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/netfilter
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.12 | 6.12.97 | 2b8e7aaa3800 |
| 3.12 | 6.18.40 | 5c9c67cf7a3d |
| 3.12 | 7.1.5 | ea3d2caa5bfa |
| 3.12 | 7.2 | 992c20bc8a4a |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- synproxy_tstamp_adjust() runs in ipv4/ipv6_synproxy_hook on received TCP segments after SYNPROXY handshake; internet-facing gateways with SYNPROXY enabled process attacker-crafted inbound packets, matching CNA precedent for remote synproxy packet bugs.
- AC:LAttack complexity, low
- Once SYNPROXY with timestamps is active and tsoff is set, the attacker fully controls TCP option layout and can reliably place TCPOPT_TIMESTAMP so op[2]/op[6] are 2-mod-4 unaligned (e.g. MSS+SACK_PERM+two NOPs+TIMESTAMP), deterministically hitting the misaligned __be32 access.
- PR:NPrivileges required, none
- Exploitation requires only sending TCP traffic to a host where an administrator already enabled SYNPROXY/nftables synproxy with timestamps; the remote attacker needs no local account, capability, or authentication on the target.
- UI:NUser interaction, none
- The netfilter hook processes matching TCP segments automatically during normal connection handling; no victim user action beyond routine network connectivity to the protected service is required.
- S:UScope, unchanged
- An alignment fault in synproxy timestamp adjustment panics or oopses the host kernel but does not cross VM, container, IOMMU, or other security boundaries; impact remains within the same kernel authority.
- C:NConfidentiality impact, none
- The flaw is misaligned load/store of the packet's own TCP timestamp fields inside the skb buffer, not an out-of-bounds or use-after-free read of kernel memory; on strict-alignment architectures it faults immediately without disclosing attacker-inaccessible data.
- I:NIntegrity impact, none
- No kernel metadata or adjacent structures are corrupted; the write only adjusts the intended timestamp value in the TCP option bytes, and strict-alignment targets fault before any unintended modification can occur.
- A:HAvailability impact, high
- The commit and fault mechanism confirm that direct misaligned __be32 dereference on strict-alignment architectures (e.g. SPARC, some ARM) causes a kernel alignment fault/oops/panic, fully denying availability on SYNPROXY-protected gateways and embedded routers.