CVE-2026-52915: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-52915 Overview

CVE-2026-52915 is an out-of-bounds array access vulnerability in the Linux kernel's IPv6 netfilter ip6t_hbh module. The struct ip6t_opts structure stores at most IP6T_OPTS_OPTSNR (16) option descriptors, but the hbh_mt6_check() function fails to reject larger optsnr values supplied from userspace. This validation gap allows callers configuring iptables rules to trigger an off-by-one or larger out-of-bounds access against the fixed-size opts[IP6T_OPTS_OPTSNR] array. UBSAN reports confirm the issue with the message array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29, where index 16 is out of range for type __u16 [16].

Critical Impact
A local user with the ability to install ip6tables rules can cause kernel memory corruption or instability through the netfilter Hop-by-Hop options match.

Affected Products

Linux kernel versions containing the ip6t_hbh netfilter match module prior to the fix
Linux kernel stable trees referenced by commits 2d523ba, 41ec2e2, 4322dcd, 57b0ac5, 588933f, 6feb43c, 784aade, and db02504
IPv6-enabled systems using iptables/ip6tables with Hop-by-Hop options matching

Discovery Timeline

2026-06-24 - CVE CVE-2026-52915 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52915

Vulnerability Analysis

The vulnerability resides in net/ipv6/netfilter/ip6t_hbh.c within the Linux kernel netfilter subsystem. The ip6t_hbh module implements packet matching against IPv6 Hop-by-Hop and Destination options headers. It relies on struct ip6t_opts, which contains a fixed-size array opts[IP6T_OPTS_OPTSNR] where IP6T_OPTS_OPTSNR equals 16. When a user installs an ip6tables rule using this match, the hbh_mt6_check() checkentry routine validates the rule data before it becomes active.

The checkentry path did not validate that the user-supplied optsnr field stayed within the bounds of the fixed opts array. As a result, a caller could submit a value of 16 or greater, leading the packet matching path to dereference past the end of the array. UBSAN flagged this as an array-index-out-of-bounds at line 110 of ip6t_hbh.c.

Root Cause

The root cause is missing input validation on a user-controlled count field in the rule setup path [CWE-129]. The fix follows the existing xtables pattern of rejecting invalid user-provided counts inside checkentry(), ensuring only match data that fits the fixed-size opts array can be installed. The packet matching fast path remains unchanged.

Attack Vector

Exploitation requires the ability to install netfilter rules, which generally requires CAP_NET_ADMIN in the relevant network namespace. On systems where unprivileged user namespaces are enabled, a local unprivileged user can obtain CAP_NET_ADMIN within a new namespace and submit a crafted ip6t_opts payload with optsnr exceeding 16. The resulting out-of-bounds access can read or corrupt adjacent kernel memory and may produce kernel instability or contribute to a larger exploitation chain.

The vulnerability is reachable only through the rule configuration interface, not via received network traffic. No verified public exploit code is available for this issue; refer to the referenced kernel commits for the corrected validation logic.

Detection Methods for CVE-2026-52915

Indicators of Compromise

Kernel log entries from UBSAN reporting array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c
Unexpected oops, WARN, or panic messages referencing hbh_mt6_check or hbh_mt6 symbols
Unprivileged processes invoking setsockopt with IPT_SO_SET_REPLACE or IP6T_SO_SET_REPLACE targeting the hbh or dst matches

Detection Strategies

Enable CONFIG_UBSAN_BOUNDS on test or canary kernels to surface the out-of-bounds access at runtime
Audit auditd records for netlink and setsockopt activity tied to xt_table modifications from non-administrative accounts
Inspect process telemetry for unexpected use of iptables-restore or ip6tables by service accounts that should not modify firewall state

Monitoring Recommendations

Forward dmesg and /var/log/kern.log into a centralized log pipeline and alert on UBSAN, KASAN, or oops messages referencing ip6t_hbh
Monitor creation of user namespaces by unprivileged processes combined with subsequent netfilter configuration syscalls
Track loaded kernel modules and flag systems where ip6t_hbh is loaded on hosts that do not require IPv6 firewall option matching

How to Mitigate CVE-2026-52915

Immediate Actions Required

Apply the stable kernel update that includes one of the upstream fix commits referenced by the Linux kernel maintainers
Disable unprivileged user namespaces where they are not required by setting kernel.unprivileged_userns_clone=0 to remove the local attack path
Unload and blacklist the ip6t_hbh module on systems that do not need IPv6 Hop-by-Hop options matching

Patch Information

The Linux kernel maintainers resolved the issue by adding optsnr validation in hbh_mt6_check() so that only rules whose option counts fit within IP6T_OPTS_OPTSNR are accepted. Fixes are distributed across stable trees in commits 2d523ba, 41ec2e2, 4322dcd, 57b0ac5, 588933f, 6feb43c, 784aade, and db02504. Distribution vendors should ship updated kernels mapped to these commits.

Workarounds

Blacklist the ip6t_hbh module via /etc/modprobe.d/ to prevent it from loading on hosts without an operational need
Restrict CAP_NET_ADMIN by disabling unprivileged user namespaces and tightening container runtime capability sets
Use nftables rather than legacy ip6tables Hop-by-Hop matches where feasible, reducing the surface exposed by xt_hbh

bash

# Disable unprivileged user namespaces (reduces local reachability)
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/99-cve-2026-52915.conf

# Prevent ip6t_hbh from loading on hosts that do not need it
echo 'install ip6t_hbh /bin/true' > /etc/modprobe.d/blacklist-ip6t_hbh.conf

# Verify the module is not currently loaded
lsmod | grep ip6t_hbh