CVE-2026-45844 Overview
CVE-2026-45844 is a Linux kernel vulnerability in the netfilter subsystem affecting arp_tables ARP payload parsing for IEEE1394 (FireWire) interfaces. The function arp_packet_match() unconditionally parses ARP payloads under the assumption that both source and target hardware addresses are present. IPv4-over-IEEE1394 ARP, defined in RFC 2734, omits the target hardware address field, causing the parser to read incorrect bytes from the packet. The result is incorrect arptables filtering decisions, where packets that should be accepted may be dropped and vice versa. The companion function arpt_mangle suffers from the same offset miscalculation, leading to packet corruption when mangling targets these fields.
Critical Impact
Incorrect filtering and packet corruption on IEEE1394 interfaces can bypass intended arptables policy enforcement on affected Linux kernels.
Affected Products
- Linux kernel netfilter subsystem (arp_tables module)
- Systems exposing IPv4-over-IEEE1394 (FireWire) network interfaces (ARPHRD_IEEE1394)
- Distributions shipping unpatched upstream Linux kernel versions
Discovery Timeline
- 2026-05-27 - CVE-2026-45844 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45844
Vulnerability Analysis
The arp_packet_match() function in the Linux netfilterarp_tables code assumes a standard ARP layout with two hardware addresses, source and target. The helper arp_hdr_len() correctly returns a shorter length for ARPHRD_IEEE1394 devices because IPv4-over-IEEE1394 ARP per RFC 2734 omits the target hardware address. However, arp_packet_match() does not consult this layout difference when computing offsets.
On IEEE1394 interfaces, the parser advances past a nonexistent target hardware address. It then reads the wrong bytes for both the target device address comparison and the target IP address. Rules match against unrelated payload data, producing incorrect accept or drop verdicts.
The ARP stack in net/ipv4/arp.c, specifically arp_create and arp_process, already handles this layout by skipping the target hardware address for ARPHRD_IEEE1394. The fix applies the same pattern to arp_packet_match() and forces a no-match result whenever a rule targets the hardware address on these interfaces.
Root Cause
The root cause is an input validation and layout assumption error [Improper Input Validation]. The parser hardcodes the standard ARP structure and ignores hardware-type-specific variations. Offset arithmetic in arpt_mangle compounds the issue by writing to incorrect locations during target IP or hardware address modification.
Attack Vector
The vulnerability is triggered by ARP traffic on an ARPHRD_IEEE1394 interface when arptables rules are configured on the host. A local administrator or adjacent attacker on a FireWire link can cause incorrect filtering outcomes or trigger packet corruption through mangle operations. Exploitability depends on the presence of IEEE1394 networking and active arptables rules.
No verified public exploit code is available. Refer to the upstream kernel commits for the technical fix.
Detection Methods for CVE-2026-45844
Indicators of Compromise
- Unexpected arptables accept or drop decisions on hosts with active IEEE1394 (FireWire) network interfaces.
- Corrupted ARP packets observed on FireWire links where arptables mangle rules target hardware or IP address fields.
- Kernel versions matching pre-patch commits referenced in the upstream stable tree.
Detection Strategies
- Inventory Linux hosts and identify those exposing ARPHRD_IEEE1394 interfaces through ip link output or /sys/class/net/*/type values.
- Audit arptables rule sets for rules referencing target hardware address matches or mangle operations on the target hardware or IP fields.
- Compare running kernel build identifiers against the fixed commits published by the Linux stable tree.
Monitoring Recommendations
- Log arptables rule hit counters and correlate against expected traffic baselines on FireWire-enabled hosts.
- Capture ARP traffic on IEEE1394 interfaces and validate packet integrity for mangle-affected fields.
- Track kernel package updates through configuration management to confirm patched builds are deployed.
How to Mitigate CVE-2026-45844
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor builds are available.
- Remove or disable IEEE1394 networking modules on systems that do not require FireWire IP networking.
- Review arptables rule sets and eliminate matches or mangle operations against target hardware addresses on IEEE1394 interfaces.
Patch Information
The fix is committed to the Linux kernel stable tree. Relevant commits include 03ea11dbefaa, 1c55053f8ffd, 1e8e3f449b1e, ac698d81fd66, and ad9973df8e0e. The patch updates arp_packet_match() to return no-match for target hardware address checks on ARPHRD_IEEE1394 and updates arpt_mangle to drop packets when mangling those fields on IEEE1394 devices.
Workarounds
- Blacklist the firewire-net kernel module on hosts where IPv4-over-IEEE1394 is not required.
- Avoid configuring arptables rules that match or mangle target hardware or IP address fields on hosts with FireWire interfaces.
- Restrict physical and logical access to FireWire ports to limit adjacent-attacker exposure.
# Configuration example: blacklist the firewire networking module
echo "blacklist firewire-net" | sudo tee /etc/modprobe.d/blacklist-firewire-net.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
