GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80637 (GCVE-0-2026-80637)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
netfilter: synproxy: fix unaligned memory access in timestamp adjustment
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory access or even a crash on strict alignment architectures. This follows the implementation of timestamp parsing in the networking stack at tcp_parse_options() and synproxy_parse_options().
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < 2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4 (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < 5c9c67cf7a3d16051dfb90e98836f530964dfb8e (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7 (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < 992c20bc8a4aba220c8b95b467d049289778dad6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "5c9c67cf7a3d16051dfb90e98836f530964dfb8e",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "992c20bc8a4aba220c8b95b467d049289778dad6",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\n\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\nwrite the timestamp fields. This prevents performance degradation due to\nunaligned memory access or even a crash on strict alignment\narchitectures.\n\nThis follows the implementation of timestamp parsing in the networking\nstack at tcp_parse_options() and synproxy_parse_options()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - synproxy_tstamp_adjust() runs in ipv4/ipv6_synproxy_hook on received TCP segments after SYNPROXY handshake; internet-facing gateways with SYNPROXY enabled process attacker-crafted inbound packets, matching CNA precedent for remote synproxy packet bugs.\nAC:L - Once SYNPROXY with timestamps is active and tsoff is set, the attacker fully controls TCP option layout and can reliably place TCPOPT_TIMESTAMP so op[2]/op[6] are 2-mod-4 unaligned (e.g. MSS+SACK_PERM+two NOPs+TIMESTAMP), deterministically hitting the misaligned __be32 access.\nPR:N - Exploitation requires only sending TCP traffic to a host where an administrator already enabled SYNPROXY/nftables synproxy with timestamps; the remote attacker needs no local account, capability, or authentication on the target.\nUI:N - The netfilter hook processes matching TCP segments automatically during normal connection handling; no victim user action beyond routine network connectivity to the protected service is required.\nS:U - An alignment fault in synproxy timestamp adjustment panics or oopses the host kernel but does not cross VM, container, IOMMU, or other security boundaries; impact remains within the same kernel authority.\nC:N - The flaw is misaligned load/store of the packet\u0027s own TCP timestamp fields inside the skb buffer, not an out-of-bounds or use-after-free read of kernel memory; on strict-alignment architectures it faults immediately without disclosing attacker-inaccessible data.\nI:N - No kernel metadata or adjacent structures are corrupted; the write only adjusts the intended timestamp value in the TCP option bytes, and strict-alignment targets fault before any unintended modification can occur.\nA:H - The commit and fault mechanism confirm that direct misaligned __be32 dereference on strict-alignment architectures (e.g. SPARC, some ARM) causes a kernel alignment fault/oops/panic, fully denying availability on SYNPROXY-protected gateways and embedded routers."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:36.886Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c9c67cf7a3d16051dfb90e98836f530964dfb8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/992c20bc8a4aba220c8b95b467d049289778dad6"
        }
      ],
      "title": "netfilter: synproxy: fix unaligned memory access in timestamp adjustment",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80637",
    "datePublished": "2026-08-28T06:48:50.836Z",
    "dateReserved": "2026-08-26T14:34:25.777Z",
    "dateUpdated": "2026-08-29T06:21:36.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80637",
      "date": "2026-09-17",
      "epss": "0.00446",
      "percentile": "0.38019"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-29T01:05:49.000Z",
      "cve": "CVE-2026-80637",
      "id": "msrc_CVE-2026-80637",
      "initial_release_date": "2026-08-29T01:05:49.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: synproxy: fix unaligned memory access in timestamp adjustment",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80637.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80637\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:48.620\",\"lastModified\":\"2026-08-29T07:16:47.660\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\\n\\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\\nwrite the timestamp fields. This prevents performance degradation due to\\nunaligned memory access or even a crash on strict alignment\\narchitectures.\\n\\nThis follows the implementation of timestamp parsing in the networking\\nstack at tcp_parse_options() and synproxy_parse_options().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_synproxy_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"5c9c67cf7a3d16051dfb90e98836f530964dfb8e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"992c20bc8a4aba220c8b95b467d049289778dad6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_synproxy_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c9c67cf7a3d16051dfb90e98836f530964dfb8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/992c20bc8a4aba220c8b95b467d049289778dad6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T06:59:40+00:00",
      "cve": "CVE-2026-80637",
      "id": "CVE-2026-80637",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: synproxy: fix unaligned memory access in timestamp adjustment",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80637.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:10:25Z",
      "cve": "CVE-2026-80637",
      "id": "CVE-2026-80637",
      "initial_release_date": "2026-08-28T16:35:35Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80637",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80637.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…