NetSight
IP …
high8.2

CVE-2026-43190

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net…

Impact

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining option length. If the last byte of the option field is not EOL/NOP (0/1), the code attempts to index op[i+1]. In the case where i + 1 == optlen, this causes an out-of-bounds read, accessing memory past the optlen boundary (either reading beyond the stack buffer _opt or the following payload).

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.12.1 before 5.10.252
from 5.11 before 5.15.202
from 5.16 before 6.1.165
from 6.2 before 6.6.128
from 6.7 before 6.12.75
from 6.13 before 6.18.16

Weakness classification

CWE-125

References