Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped. This matches the existing get_unaligned_be32() use later in the same function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-24T17:17:19.457Z",
  "pubdate": "2026-09-24T17:17:19.457Z",
  "executiveSummary": "A memory alignment vulnerability exists within the Linux kernel's netfilter subsystem, specifically in the tcp_sack() function.\nThe vulnerability type is categorized as an unaligned memory access flaw during the processing of TCP option streams.\nThis issue affects the nf_conntrack module within the Linux kernel. It poses a risk of system instability, kernel panics, or potential denial-of-service (DoS) conditions due to improper handling of non-4-byte aligned data structures.\nAn attacker capable of crafting specific TCP packets with malformed or misaligned TCP options could trigger a kernel exception.\nThe impact is significant on systems running affected kernel versions, as unauthorized or malformed network traffic can lead to immediate system crashes on architectures that strictly enforce memory alignment.\nExploitation requirements include the ability to send packets through a network path monitored by the affected nf_conntrack implementation. Authentication is not required for the attacker to reach this code path, as it resides within the network stack processing logic.",
  "technicalDetails": "The vulnerability originates in the tcp_sack() function, which is responsible for parsing TCP SACK options within the netfilter connection tracking (nf_conntrack) implementation of the Linux kernel.\nThe root cause is a violation of memory alignment expectations during the fast-path processing of TCP timestamp options. The code attempts to dereference the TCP option stream by casting the pointer directly to an __be32 pointer: *(__be32 *)ptr. In the context of the TCP protocol, option headers are not guaranteed to be aligned on 4-byte boundaries.\nOn architectures with strict alignment requirements (such as ARM or SPARC), performing a 32-bit read from an unaligned address triggers a hardware exception, resulting in a kernel oops or a system crash. Even on architectures that support unaligned access in hardware (such as x86), direct dereferencing of misaligned pointers is considered undefined behavior in C and can lead to performance degradation or incorrect data processing.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious TCP segment containing carefully constructed TCP options. By manipulating the size and sequence of preceding options, the attacker forces the 'ptr' offset within the TCP header to fall on a non-4-byte boundary (e.g., at an offset of 1, 2, or 3 relative to a 4-byte boundary). 2) The victim's Linux kernel receives the segment, and the nf_conntrack subsystem passes the segment to the tcp_sack() function for parsing. 3) The function reaches the timestamp-only fast path and attempts to dereference the misaligned 'ptr' as a 32-bit big-endian integer. 4) The hardware or CPU architecture detects the unaligned access, triggering a fault handler that halts the kernel execution flow to prevent corruption or undefined state.\nThe remediation involves replacing the direct pointer dereference with the get_unaligned_be32() macro. This utility function provides a safe abstraction for reading 32-bit values from potentially unaligned memory locations. Furthermore, because get_unaligned_be32() already performs the byte-swap required to convert from network byte order to host byte order, the code successfully eliminates the redundant and potentially incorrect usage of the htonl() constant in the subsequent comparison logic."
}