SECUFOCUSNOW
Home›CVE index›CVE-2026-46244
Review reviewCritical

CVE-2026-46244

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass....

CVSS
9.1
EPSS
0.32%
24.7% percentile
CISA KEV
Not listed
Published
2026.06.04
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.32%
Technical severityCVSS 9.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass....

Affected product and versions

Product
Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
>= 3a07327d10a09379315c844c63f27941f5081e0a < c161ad9157f5a0429b5ff94d9770faf3bf48d273, >= 3a07327d10a09379315c844c63f27941f5081e0a < 870d59e2cf218e7418491e26bad768cb16654582, >= 3a07327d10a09379315c844c63f27941f5081e0a < 689bbf48c1f45130086ae1c46ab83ea4c753c601, >= 3a07327d10a09379315c844c63f27941f5081e0a < d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce, >= 3a07327d10a09379315c844c63f27941f5081e0a < b6a91f68ebfed9c38e0e9150f58a9b85da07181c, >= 6.2, >= 6.2 < 6.6.142, >= 6.7 < 6.12.92, >= 6.13 < 6.18.34, >= 6.19 < 7.0.11, 7.1
Fixed versions
6.6.142, 6.12.92, 6.18.34, 7.0.11

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
CWE-823
CVE-2026-46244 — Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support | SECUFOCUS NOW