CVE-2026-46244

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

• CWE-823

• https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601Patch
• https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582Patch
• https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181cPatch
• https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273Patch
• https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279cePatch
• https://access.redhat.com/errata/RHSA-2026:33215
• https://access.redhat.com/errata/RHSA-2026:34094
• https://access.redhat.com/errata/RHSA-2026:34443
• https://access.redhat.com/errata/RHSA-2026:34911
• https://access.redhat.com/errata/RHSA-2026:36018
• https://access.redhat.com/security/cve/CVE-2026-46244
• https://bugzilla.redhat.com/show_bug.cgi?id=2484451
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46244.json

Published

Jun 3, 2026

Last Modified

Jul 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46239In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-4624A vulnerability was detected in SourceCodester Online Librar…7.3
• CVE-2026-46240In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46241In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46242In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46243In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-46245In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46246In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46247In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46248In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46249In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-4625A flaw has been found in SourceCodester Online Admission Sys…7.3