CVE-2026-52915: Linux Kernel Netfilter IPv6 Hop-by-Hop Array Out-of-Bounds Vulnerability

Technical summary

The vulnerability resides in the netfilter ip6t_hbh module, specifically in the `hbh_mt6_check()` function which validates IPv6 hop-by-hop header matching rules. The `struct ip6t_opts` data structure contains a fixed-size array `opts[IP6T_OPTS_OPTSNR]` with 16 slots for option descriptors. The vulnerability occurs because user-supplied `optsnr` values (option count) are not validated during rule setup, allowing counts exceeding 16 to be installed. This leads to an array index out-of-bounds condition when the packet matching path attempts to access the `opts` array using an invalid index. The issue is classified as CWE-129 (Improper Validation of Array Index) and can be exploited through direct manipulation of netfilter rule configuration by unprivileged local users.

Business impact

Organizations relying on Linux-based systems for network security, including firewalls, load balancers, and cloud infrastructure, face a localized privilege escalation risk. An unprivileged user on an affected system can destabilize the kernel or gain elevated capabilities, potentially compromising the confidentiality and integrity of system operations. In containerized or multi-tenant environments, this becomes particularly concerning as it provides a path for lateral movement and container escape. The impact extends to any deployment where local user access is possible—development systems, shared hosting, and environments with guest accounts.

Affected systems

All Linux kernel versions containing the unfixed ip6t_hbh netfilter module are affected. Distributions include all mainstream kernels (RHEL, Ubuntu, Debian, SUSE, Fedora, and others) until patched. The vulnerability requires the netfilter IPv6 extensions module to be loaded and netfilter rules involving hop-by-hop headers to be configured; however, even passive loading of the vulnerable code path during rule validation is sufficient for exploitation. Verify your kernel version and ensure it includes the fix resolving the optsnr validation in hbh_mt6_check().

Exploitability

Exploitation is straightforward and requires only local user access (no authentication required beyond a standard unprivileged account). An attacker uses standard netfilter tools (iptables or ip6tables) to craft a hop-by-hop matching rule with an artificially inflated option count, triggering the out-of-bounds condition immediately during rule installation. The CVSS vector reflects local attack surface (AV:L) and low attack complexity (AC:L), but the requirement for local access and user privilege (PR:L) prevents remote exploitation. No special network conditions or social engineering are needed; the attack is deterministic and repeatable. The lack of KEV status indicates this is not yet widely exploited in the wild, but the simplicity of the trigger makes it a candidate for rapid weaponization.

Remediation

The fix involves adding explicit validation of the `optsnr` field in the `hbh_mt6_check()` function to reject any rule with an option count exceeding `IP6T_OPTS_OPTSNR` (16). This validation mirrors existing xtables security patterns used elsewhere in the netfilter codebase. The corrected code path verifies user-supplied counts during rule setup (checkentry phase) rather than during packet matching, keeping runtime performance unaffected. Patched kernel versions will include this check and prevent installation of malformed rules.

Patch guidance

Verify and apply the latest stable kernel update from your distribution as soon as it becomes available. For RHEL/CentOS, Ubuntu, Debian, and other major distributions, monitor security advisory channels for kernel updates addressing CVE-2026-52915. If you maintain a custom kernel build, backport the netfilter ip6t_hbh validation fix from upstream Linux. Test patches in a non-production environment first to ensure netfilter rule compatibility. Restart affected services or reboot systems after kernel installation to load the corrected module. If immediate patching is not possible, consider disabling IPv6 hop-by-hop header filtering rules or restricting local user access on systems where this capability is not required.

Detection guidance

Monitor system logs for UBSAN (Undefined Behavior Sanitizer) warnings originating from ip6t_hbh.c, particularly array-index-out-of-bounds messages referencing index 16 or higher on the opts array. If kernel debugging is enabled, watch for kernel panic or oops messages tied to netfilter during firewall rule installation. Use kernel audit rules to log all netfilter rule changes (iptables -A or ip6tables -A commands) and correlate them with system instability or permission escalation attempts. Deploy intrusion detection signatures that flag attempts to load oversized hop-by-hop option configurations in netfilter rules. Check running iptables/ip6tables rule sets for any suspiciously large option counts in hop-by-hop match rules (use `iptables -L -n` or `ip6tables -L -n` and inspect rule details).

Why prioritize this

This vulnerability combines moderate attack accessibility (requires local user access), deterministic exploitability, and significant potential impact (privilege escalation and kernel crash). The HIGH CVSS score (7.1) reflects the severity in environments where local user access is common or expected, such as development systems, shared servers, multi-tenant cloud instances, or container hosts. Although not yet tracked in the KEV catalog, the simplicity of the exploit trigger and the presence of array-out-of-bounds conditions historically predicts rapid adoption by threat actors. Prioritize patching for systems exposed to untrusted local users.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is justified by: (1) local attack vector (AV:L) reflecting the need for prior system access; (2) low attack complexity (AC:L) because no special conditions or user interaction are needed; (3) low privilege requirement (PR:L) allowing standard unprivileged users to trigger the flaw; (4) high confidentiality impact (C:H) from potential out-of-bounds read access; (5) high availability impact (A:H) from kernel crashes or resource exhaustion; and (6) unchanged integrity scope (S:U, I:N) because the primary risk is reading or crashing, not writing to protected memory in this specific configuration. The score appropriately elevates the issue above MEDIUM because the local privilege escalation path and kernel stability impact pose significant risk to multi-user and containerized deployments.

Frequently asked questions