Secuno
ENNL
Book demo

CVE-2026-46244

Linux Kernel vulnerability

9.1 CRITICALEPSS 0.46%
  1. Published3 Jun 2026

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Linux Kernel≥ 6.13 < 6.18.34 · ≥ 6.19 < 7.0.11 · ≥ 6.2 < 6.6.142 · ≥ 6.7 < 6.12.92

Remediation

Fixed in
Linux Kernel≥ 6.18.34

References

and 6 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-726428.8
The native inference process that Elasticsearch uses to evaluate uploaded machine…
CVE-2026-122908.1
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152,…
CVE-2026-217329.6
A web page that contains unusual GPU shader code is loaded into the GPU compiler…
CVE-2025-270598.8
Memory corruption while performing SCM…
CVE-2025-04678.2
Kernel software installed and running inside a Guest VM may exploit memory shared with…
CVE-2024-423868.2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14…

Frequently asked

Is CVE-2026-46244 being actively exploited?

CVE-2026-46244 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.46%.

How severe is CVE-2026-46244?

CVE-2026-46244 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.46% probability of exploitation.

Which products are affected by CVE-2026-46244?

Affected products include Linux Kernel.

How do I fix CVE-2026-46244?

Upgrade affected software to a fixed version, for example Linux Kernel 6.18.34 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-46244 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.