HIGH Introduced in 3.12
netfilter Synproxy Unaligned
CVE-2026-80637
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory access or even a crash on strict alignment architectures. This follows the implementation of timestamp parsing in the networking stack at tcp_parse_options() and synproxy_parse_options().
02KernelScan AI Analysis
Risk summary
The netfilter SYNPROXY module performs unaligned memory reads and writes when adjusting TCP timestamp options in forwarded packets. On strict-alignment architectures this can cause a kernel crash, resulting in a denial of service. The issue is reachable by any remote attacker who can send TCP traffic through a host running SYNPROXY, requiring no privileges or user interaction.
Vulnerability analysis
The netfilter SYNPROXY module adjusts TCP timestamp values using regular memory accesses that assume the data is aligned. On strict-alignment architectures, a timestamp option at an unaligned address causes a kernel crash when the module processes a forwarded packet. The correction switches to alignment-safe accessors so the code works correctly regardless of how the option is positioned in the packet. Any remote attacker who can send TCP traffic through a host running SYNPROXY can trigger the flaw without credentials.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 3.12 | 6.12.97 | 2b8e7aaa3800 |
| 6.18 | 3.12 | 6.18.40 | 5c9c67cf7a3d |
| 6.6 | 3.12 | 6.6.160 | 95cda0446f51 |
| 7.1 | 3.12 | 7.1.5 | ea3d2caa5bfa |
| mainline | 3.12 | 7.2 | 992c20bc8a4a |
| cip/6.12 | 3.12 | 6.12.101-cip29 | 2b8e7aaa3800 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |