Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory access or even a crash on strict alignment architectures. This follows the implementation of timestamp parsing in the networking stack at tcp_parse_options() and synproxy_parse_options().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:48.620Z",
  "pubdate": "2026-08-28T08:16:48.620Z",
  "executiveSummary": "The Linux kernel's netfilter synproxy module contains a vulnerability related to improper memory handling during TCP timestamp adjustment. The issue stems from the direct memory access of timestamp fields without adhering to architectural alignment requirements. This results in performance degradation or system instability, potentially manifesting as a kernel panic on strict-alignment hardware architectures.\nThe vulnerability is classified as an unaligned memory access flaw. It affects the network stack's handling of TCP options within synproxy, a mechanism used to protect against SYN floods. The risk primarily involves potential denial-of-service scenarios where malformed or specific network traffic triggers a crash on susceptible CPU architectures. There are no specific authentication or privilege requirements to trigger this condition, as it relies on incoming network traffic processed by the kernel's netfilter subsystem. The vulnerability is effectively a robustness issue within the kernel's memory management layer, requiring developers to employ specific accessor macros to ensure hardware-agnostic data alignment.",
  "technicalDetails": "The root cause of this vulnerability is the use of standard pointer dereferencing for timestamp fields within the netfilter synproxy implementation. In the context of TCP option processing, timestamp values are frequently embedded within packet headers at offsets that may not align with the word size of the underlying processor architecture. On architectures that strictly enforce memory alignment (such as specific ARM, SPARC, or MIPS configurations), accessing a multi-byte integer at an unaligned memory address triggers a hardware exception.\nThe vulnerable component is identified within the netfilter synproxy timestamp adjustment logic. When the kernel attempts to read or write the TCP timestamp fields, the code performs direct memory access rather than utilizing architecture-aware primitives. This approach ignores the potential for unaligned buffers passed through the networking stack, which is contrary to best practices established in other parts of the kernel, such as tcp_parse_options() and synproxy_parse_options().\nThe exploitation flow begins when an attacker sends a crafted TCP packet containing options that shift the timestamp field to an unaligned memory location. As the netfilter synproxy module parses these options, it attempts to read the timestamp value directly. On strict-alignment architectures, this immediate dereference causes the CPU to raise an alignment fault exception. If the kernel is not configured to handle such exceptions gracefully, the resulting kernel oops or fault leads to an immediate system crash.\nWhile this vulnerability is often categorized as a stability or performance issue, the impact can be elevated to a denial-of-service (DoS) condition. An attacker capable of sending traffic that reaches the synproxy hook can remotely induce a system crash without prior authentication. The post-exploitation impact is limited to the exhaustion of system availability; there is no evidence that this specific memory access flaw allows for arbitrary code execution or privilege escalation. The fix involves replacing direct pointer dereferences with get_unaligned_be32() and put_unaligned_be32() macros, which provide the necessary abstraction to handle data access regardless of the memory alignment, ensuring that the kernel reads and writes the 32-bit values safely across all supported architectures."
}