AZL-88644
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-88644.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-88644
- Upstream
- Published
- 2026-05-27T11:16:23Z
- Modified
- 2026-08-28T17:47:38.151852138Z
- Summary
- CVE-2026-45841 affecting package kernel for versions less than 6.6.141.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlinkosf: fix divide-by-zero in OSFWSS_MODULO
nfosfmatchone() computes ctx->window % f->wss.val in the OSFWSSMODULO branch with no guard for f->wss.val == 0. A CAPNET_ADMIN user can add such a fingerprint via nfnetlink; a subsequent matching TCP SYN divides by zero and panics the kernel.
Reject the bogus fingerprint in nfnlosfaddcallback() above the per-option for-loop. f->wss is per-fingerprint, not per-option, so the check must run regardless of f->optnum (including 0). Also reject wss.wc >= OSFWSSMAX; nfosfmatch_one() already treats that as "should not happen".
Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:nfosfmatchone (net/netfilter/nfnetlinkosf.c:98) Call Trace: <IRQ> nfosfmatch (net/netfilter/nfnetlinkosf.c:220) xtosfmatchpacket (net/netfilter/xtosf.c:32) iptdotable (net/ipv4/netfilter/iptables.c:348) nfhookslow (net/netfilter/core.c:622) iplocaldeliver (net/ipv4/ipinput.c:265) iprcv (include/linux/skbuff.h:1162) __netifreceiveskb_onecore (net/core/dev.c:6181) processbacklog (net/core/dev.c:6642) __napipoll (net/core/dev.c:7710) netrxaction (net/core/dev.c:7945) handlesoftirqs (kernel/softirq.c:622)
- References