CVE-2026-45841: Linux Kernel Netfilter DoS Vulnerability

CVE-2026-45841 Overview

CVE-2026-45841 is a divide-by-zero vulnerability in the Linux kernel's netfilter subsystem, specifically in the nfnetlink_osf (OS fingerprinting) module. The function nf_osf_match_one() computes ctx->window % f->wss.val in the OSF_WSS_MODULO branch without validating that f->wss.val is non-zero. A user with CAP_NET_ADMIN can register a crafted fingerprint via nfnetlink, and a subsequent matching TCP SYN packet triggers a division-by-zero, panicking the kernel.

Critical Impact
A local privileged user can trigger a kernel panic by registering a malformed OS fingerprint, resulting in a denial of service against the host.

Affected Products

Linux kernel versions containing the nfnetlink_osf module prior to the upstream fix
Distributions shipping the affected net/netfilter/nfnetlink_osf.c code path
Systems with xt_osf netfilter matching enabled

Discovery Timeline

2026-05-27 - CVE-2026-45841 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45841

Vulnerability Analysis

The vulnerability resides in nf_osf_match_one() within net/netfilter/nfnetlink_osf.c at the OSF_WSS_MODULO handling branch. The function performs ctx->window % f->wss.val without verifying that f->wss.val is non-zero. When the divisor is zero, the CPU raises a divide-error exception in kernel context, which the kernel reports as Oops: divide error and terminates the affected execution path.

The registration path nfnl_osf_add_callback() accepts fingerprint structures from userspace but did not validate wss fields independently of opt_num. Because wss is a per-fingerprint attribute and not a per-option attribute, the missing check allowed fingerprints with wss.val == 0 and wss.wc == OSF_WSS_MODULO to be inserted. The crash propagates from the softirq receive path through ip_rcv → ip_local_deliver → nf_hook_slow → ipt_do_table → xt_osf_match_packet.

Root Cause

The root cause is missing input validation on a kernel structure received from privileged userspace via nfnetlink. The fingerprint loader iterated over per-option entries but never validated the per-fingerprint wss field. The fix adds a check above the per-option loop that rejects fingerprints when wss.wc == OSF_WSS_MODULO and wss.val == 0, and also rejects wss.wc >= OSF_WSS_MAX, an out-of-range condition that nf_osf_match_one() already considered unreachable.

Attack Vector

Exploitation requires CAP_NET_ADMIN in the relevant network namespace. A user with this capability constructs and submits a malformed OS fingerprint over nfnetlink. After the fingerprint is loaded, any inbound TCP SYN packet that matches against the OSF table executes the divide-by-zero, panicking the kernel and producing the trace shown in the upstream report:

Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
Call Trace:
 <IRQ>
  nf_osf_match (net/netfilter/nfnetlink_osf.c:220)
  xt_osf_match_packet (net/netfilter/xt_osf.c:32)
  ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
  nf_hook_slow (net/netfilter/core.c:622)
  ip_local_deliver (net/ipv4/ip_input.c:265)
  ip_rcv (include/linux/skbuff.h:1162)

No synthetic exploit code is reproduced here; refer to the upstream patches for the precise fix and reproducer context.

Detection Methods for CVE-2026-45841

Indicators of Compromise

Kernel log entries containing Oops: divide error with RIP pointing to nf_osf_match_one
Sudden node reboots or panics correlated with inbound TCP SYN traffic on hosts using xt_osf
nfnetlink audit records showing OSF fingerprint additions from unexpected processes

Detection Strategies

Monitor dmesg and journalctl -k for divide error entries referencing the netfilter call stack
Audit use of CAP_NET_ADMIN and nfnetlink socket operations on production hosts
Inventory hosts where the xt_osf and nfnetlink_osf modules are loaded using lsmod

Monitoring Recommendations

Forward kernel crash dumps and kdump artifacts to a central log store for post-incident review
Alert on unexpected loading of nfnetlink_osf and xt_osf kernel modules on servers that do not require OS fingerprinting
Track netfilter rule changes through configuration management to detect unauthorized fingerprint additions

How to Mitigate CVE-2026-45841

Immediate Actions Required

Apply the upstream kernel patches referenced below and reboot affected hosts
Restrict CAP_NET_ADMIN to trusted administrative accounts and review existing grants in containers and namespaces
If OS fingerprinting is unused, unload and blacklist nfnetlink_osf and xt_osf

Patch Information

The issue is resolved upstream. Apply the relevant stable kernel commits:

The fix adds validation in nfnl_osf_add_callback() that rejects fingerprints with wss.wc == OSF_WSS_MODULO && wss.val == 0 and any wss.wc >= OSF_WSS_MAX.

Workarounds

Unload the affected modules where unused: modprobe -r xt_osf nfnetlink_osf
Add install nfnetlink_osf /bin/true and install xt_osf /bin/true to /etc/modprobe.d/ to prevent reload
Drop CAP_NET_ADMIN from containers and unprivileged workloads that do not require netfilter administration

bash

# Configuration example: disable OS fingerprinting modules until patched
echo 'install nfnetlink_osf /bin/true' | sudo tee /etc/modprobe.d/disable-osf.conf
echo 'install xt_osf /bin/true' | sudo tee -a /etc/modprobe.d/disable-osf.conf
sudo modprobe -r xt_osf nfnetlink_osf 2>/dev/null || true
lsmod | grep -E 'osf'