CVE-2026-6244: libpcap BPF Interpreter DOS Vulnerability

CVE-2026-6244 Overview

CVE-2026-6244 affects the libpcap Berkeley Packet Filter (BPF) interpreter. The interpreter fails to validate the immediate value for the div #k and mod #k ALU instructions. A crafted filter program that supplies a zero immediate value triggers a division-by-zero condition inside pcap_offline_filter(). The result is a process-level crash affecting availability of applications that consume attacker-influenced BPF programs.

The flaw is categorized as an Improper Check for Unusual or Exceptional Conditions [CWE-369]. Exploitation requires local access and the ability to submit a filter program to a vulnerable consumer of libpcap.

Critical Impact
A local actor supplying a crafted BPF filter program causes a division-by-zero fault in pcap_offline_filter(), terminating the host process and disrupting packet capture or analysis workflows.

Affected Products

libpcap versions prior to the commit 98bb921b141aa642faedbf2ac510541c76499a19
Downstream tools consuming libpcap's BPF interpreter (for example, tcpdump-family utilities and packet analysis tooling)
Applications invoking pcap_offline_filter() on untrusted or attacker-influenced BPF programs

Discovery Timeline

2026-09-05 - CVE-2026-6244 published to the National Vulnerability Database
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-6244

Vulnerability Analysis

The libpcap BPF interpreter executes filter programs made up of ALU opcodes. Two of these opcodes, BPF_ALU|BPF_DIV|BPF_K and BPF_ALU|BPF_MOD|BPF_K, perform division and modulo operations using an immediate value pc->k provided by the filter program itself.

The interpreter dispatches these opcodes without first checking whether pc->k equals zero. When a filter program supplies zero as the immediate operand, the interpreter performs an integer divide-by-zero. On most platforms this raises SIGFPE and terminates the host process. The vulnerability is reachable through pcap_offline_filter(), which applies caller-supplied BPF programs to packet data. The impact is limited to availability. There is no memory corruption, no information disclosure, and no code execution path.

Root Cause

The interpreter trusted the immediate value embedded in the BPF program. The div and mod opcode handlers dereferenced pc->k directly in an arithmetic operation without a guard clause. Because BPF filter programs are attacker-controllable in uncommon deployments, this omission allowed a crafted program to force undefined arithmetic behavior.

Attack Vector

Exploitation requires local access and low privileges. An attacker supplies a filter program containing a div #0 or mod #0 instruction to a process that invokes pcap_offline_filter(). When the interpreter reaches the malicious opcode, the process crashes. No user interaction is required.

// Source: https://github.com/the-tcpdump-group/libpcap/commit/98bb921b141aa642faedbf2ac510541c76499a19
// Patch to bpf_filter.c - adds guard clauses before the divide and modulo operations.
			continue;

		case BPF_ALU|BPF_DIV|BPF_K:
+			if (pc->k == 0)
+				return 0;
			A /= pc->k;
			continue;

		case BPF_ALU|BPF_MOD|BPF_K:
+			if (pc->k == 0)
+				return 0;
			A %= pc->k;
			continue;

The fix short-circuits execution and returns 0 when the immediate operand is zero, preventing the arithmetic fault.

Detection Methods for CVE-2026-6244

Indicators of Compromise

Unexpected SIGFPE (signal 8) terminations in processes linking libpcap, visible in dmesg, journalctl, or core dump directories.
Repeated crashes of packet capture utilities such as tcpdump or custom analyzers when processing user-supplied filter expressions or saved capture files.
Presence of BPF filter programs containing div #0 or mod #0 opcodes in application logs or on-disk filter definitions.

Detection Strategies

Audit installed libpcap versions across Linux and BSD hosts and flag any predating commit 98bb921b141aa642faedbf2ac510541c76499a19.
Instrument applications that call pcap_offline_filter() to log the source and content of filter programs prior to execution.
Monitor for abnormal exit codes and crash loops in daemons that accept remote or user-supplied capture filters.

Monitoring Recommendations

Enable core dump collection and inspect faulting instructions for integer division against a zero divisor within libpcap frames.
Forward host crash telemetry and syslog messages to a centralized analytics platform for correlation across fleet endpoints.
Alert on repeated abnormal terminations of packet capture services within short intervals from the same local user context.

How to Mitigate CVE-2026-6244

Immediate Actions Required

Upgrade libpcap to a build that includes commit 98bb921b141aa642faedbf2ac510541c76499a19 or later.
Rebuild and redeploy any statically linked applications or containers that bundle libpcap.
Restrict which local users can submit filter programs to privileged capture services.

Patch Information

The upstream fix is committed to the tcpdump-group libpcap repository. The patch adds explicit zero-checks to the BPF_ALU|BPF_DIV|BPF_K and BPF_ALU|BPF_MOD|BPF_K opcode handlers in bpf_filter.c, causing the interpreter to return 0 rather than performing an invalid arithmetic operation. Refer to the libpcap security commit for the authoritative change.

Workarounds

Validate BPF filter programs before submission and reject any containing division or modulo opcodes with a zero immediate operand.
Limit access to interfaces and files that provide BPF filter programs to trusted local users only.
Run packet capture consumers under supervision frameworks that restart the process on SIGFPE to reduce operational disruption while patches are staged.

bash

# Verify installed libpcap version and confirm the patched build is deployed
tcpdump --version
ldconfig -p | grep libpcap
# On Debian/Ubuntu systems
apt list --installed 2>/dev/null | grep libpcap
# On RHEL/CentOS/Fedora systems
rpm -q libpcap