---
id: CVE-2026-43190
title: 'netfilter: xt_tcpmss: check remaining length before reading optlen'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: xt_tcpmss: check remaining length before reading optlen

  Quoting reporter:
    In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
   op[i+1]…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f895191dc32c53eaf443b6443fe40945b2f92287
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    cd5beda7e0e32865e214f28034bb92c1cecff885
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    eaedc0bc18be46fe7f58170e967959a932c4f824
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    07a9b32eaae792ff7d0fcac14d8920c937c0a9c3
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8b300f726640c48c3edfe9c453334dd801f4b74e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5e13d0a37666955b6cfddc0f73cb40ed645b8a05
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f6c412dcfd76b0516d51aa847d8f4c7b70381b09
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    735ee8582da3d239eb0c7a53adca61b79fb228b3
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:15:30.447142Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:35.750Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43190'
references:
  - url: 'https://git.kernel.org/stable/c/f895191dc32c53eaf443b6443fe40945b2f92287'
  - url: 'https://git.kernel.org/stable/c/cd5beda7e0e32865e214f28034bb92c1cecff885'
  - url: 'https://git.kernel.org/stable/c/eaedc0bc18be46fe7f58170e967959a932c4f824'
  - url: 'https://git.kernel.org/stable/c/07a9b32eaae792ff7d0fcac14d8920c937c0a9c3'
  - url: 'https://git.kernel.org/stable/c/8b300f726640c48c3edfe9c453334dd801f4b74e'
  - url: 'https://git.kernel.org/stable/c/5e13d0a37666955b6cfddc0f73cb40ed645b8a05'
  - url: 'https://git.kernel.org/stable/c/f6c412dcfd76b0516d51aa847d8f4c7b70381b09'
  - url: 'https://git.kernel.org/stable/c/735ee8582da3d239eb0c7a53adca61b79fb228b3'
tags:
  - cve.org
epss: 0.00463
epssPercentile: 0.38686
ingestedAt: '2026-10-16T17:24:46.686Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_tcpmss: check remaining length before reading optlen

Quoting reporter:
  In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
 op[i+1] directly without validating the remaining option length.

  If the last byte of the option field is not EOL/NOP (0/1), the code attempts
  to index op[i+1]. In the case where i + 1 == optlen, this causes an
  out-of-bounds read, accessing memory past the optlen boundary
  (either reading beyond the stack buffer _opt or the
  following payload).

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f895191dc32c53eaf443b6443fe40945b2f92287`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cd5beda7e0e32865e214f28034bb92c1cecff885`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < eaedc0bc18be46fe7f58170e967959a932c4f824`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 07a9b32eaae792ff7d0fcac14d8920c937c0a9c3`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8b300f726640c48c3edfe9c453334dd801f4b74e`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5e13d0a37666955b6cfddc0f73cb40ed645b8a05`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f6c412dcfd76b0516d51aa847d8f4c7b70381b09`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 735ee8582da3d239eb0c7a53adca61b79fb228b3`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.