SECUFOCUSNOW
Home›CVE index›CVE-2026-23397
Review reviewHigh

CVE-2026-23397

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter the option matching loop even when foptsize sums to zero, which matches packets with no TCP options where ctx->optp is NULL: Oops: general protection fault KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_...

CVSS
7.1
EPSS
0.12%
2.37% percentile
CISA KEV
Not listed
Published
2026.03.26
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.12%
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter the option matching loop even when foptsize sums to zero, which matches packets with no TCP options where ctx->optp is NULL: Oops: general protection fault KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_...

Affected product and versions

Product
Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Affected versions
>= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < e9cf17b91e733fec725ebcc0b3098bc5ccd505e0, >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 3c11b5c2436a3a5b450612ab160e3a525b28cfb5, >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < aa0574182c46963c3cdb8cde46ec93aca21100d8, >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 224f4678812e1a7bc8341bcb666773a0aec5ea6f, >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < ec8bf0571b142f29dc0b68ae2ac3952f7a464b38, >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 3932620c04c2938c93c0890c225960d3d34ba355, >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < 4c6aa008b913e808c4f4d3cde36cb1d9bb5967c6, >= 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 < dbdfaae9609629a9569362e3b8f33d0a20fd783c, >= 2.6.31, >= V3.1.6, >= V3.1.5, >= 2.6.31.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.167, >= 6.2 < 6.6.130, >= 6.7 < 6.12.78, >= 6.13 < 6.18.20, >= 6.19 < 6.19.10, 2.6.31, 7.0
Fixed versions
5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
CWE-125