---
id: CVE-2026-43452
title: 'netfilter: x_tables: guard option walkers against 1-byte tail reads'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: x_tables: guard option walkers against 1-byte tail reads

  When the last byte of options is a non-single-byte option kind, walkers
  that advance with i += op[i…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    c2a445367a496a3c25dbc940c10c8bd1cfd4c14a
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    ae1e1267650638136b84c23f2b31250f0ccb6823
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    c39f84e4be1be63fc60ca7141ea7b76edcea5907
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    9b94f0e42ed248eb31929da84ed9f5310d7ff540
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    bc18551c6169eac5ed813778d3e3e484002dbbe5
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    d04800323336eebf441d153f43234eac9b833d36
  - >-
    Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc <
    cfe770220ac2dbd3e104c6b45094037455da81d4
  - Linux 2.6.16
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:17:27.922262Z'
published: '2026-05-08'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:41.957Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43452'
references:
  - url: 'https://git.kernel.org/stable/c/c2a445367a496a3c25dbc940c10c8bd1cfd4c14a'
  - url: 'https://git.kernel.org/stable/c/ae1e1267650638136b84c23f2b31250f0ccb6823'
  - url: 'https://git.kernel.org/stable/c/c39f84e4be1be63fc60ca7141ea7b76edcea5907'
  - url: 'https://git.kernel.org/stable/c/9b94f0e42ed248eb31929da84ed9f5310d7ff540'
  - url: 'https://git.kernel.org/stable/c/5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c'
  - url: 'https://git.kernel.org/stable/c/bc18551c6169eac5ed813778d3e3e484002dbbe5'
  - url: 'https://git.kernel.org/stable/c/d04800323336eebf441d153f43234eac9b833d36'
  - url: 'https://git.kernel.org/stable/c/cfe770220ac2dbd3e104c6b45094037455da81d4'
tags:
  - cve.org
epss: 0.00633
epssPercentile: 0.4928
ingestedAt: '2026-10-16T17:24:46.696Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: guard option walkers against 1-byte tail reads

When the last byte of options is a non-single-byte option kind, walkers
that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
of the option area.

Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
in xt_tcpudp and xt_dccp option walkers.

## Affected

- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < c2a445367a496a3c25dbc940c10c8bd1cfd4c14a`
- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < ae1e1267650638136b84c23f2b31250f0ccb6823`
- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < c39f84e4be1be63fc60ca7141ea7b76edcea5907`
- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < 9b94f0e42ed248eb31929da84ed9f5310d7ff540`
- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < 5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c`
- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < bc18551c6169eac5ed813778d3e3e484002dbbe5`
- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < d04800323336eebf441d153f43234eac9b833d36`
- `Linux >= 2e4e6a17af35be359cc8f1c924f8f198fbd478cc < cfe770220ac2dbd3e104c6b45094037455da81d4`
- `Linux 2.6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.