---
id: CVE-2026-45841
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

  nf_osf_match_one() computes ctx->window % f->wss.val in the
  OSF_WSS_MODULO branch with no guard for f->w…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

  nf_osf_match_one() computes ctx->window % f->wss.val in the
  OSF_WSS_MODULO branch with no guard for f->w…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-369
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.31, < 5.10.258'
  - 'linux_kernel >= 5.11, < 5.15.209'
  - 'linux_kernel >= 5.16, < 6.1.175'
  - 'linux_kernel >= 6.2, < 6.6.141'
  - 'linux_kernel >= 6.7, < 6.12.91'
  - 'linux_kernel >= 6.13, < 6.18.33'
  - 'linux_kernel >= 6.19, < 7.0.10'
patched:
  - linux_kernel 7.0.10
published: '2026-05-27'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T09:18:06.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45841'
references:
  - url: 'https://git.kernel.org/stable/c/0694618cf3e9b120666e31f5f383a6e466d95a0d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/26900306a5a2c3e4f75c643a064525526bb6e5f3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cb833bbc1b3c51e08652d3c86298307c07d3f2db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00129
epssPercentile: 0.02963
ingestedAt: '2026-09-08T13:33:24.148Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

nf_osf_match_one() computes ctx->window % f->wss.val in the
OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A
CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a
subsequent matching TCP SYN divides by zero and panics the kernel.

Reject the bogus fingerprint in nfnl_osf_add_callback() above the
per-option for-loop. f->wss is per-fingerprint, not per-option, so
the check must run regardless of f->opt_num (including 0). Also
reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that
as "should not happen".

Crash:
 Oops: divide error: 0000 [#1] SMP KASAN NOPTI
 RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
 Call Trace:
 <IRQ>
  nf_osf_match (net/netfilter/nfnetlink_osf.c:220)
  xt_osf_match_packet (net/netfilter/xt_osf.c:32)
  ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
  nf_hook_slow (net/netfilter/core.c:622)
  ip_local_deliver (net/ipv4/ip_input.c:265)
  ip_rcv (include/linux/skbuff.h:1162)
  __netif_receive_skb_one_core (net/core/dev.c:6181)
  process_backlog (net/core/dev.c:6642)
  __napi_poll (net/core/dev.c:7710)
  net_rx_action (net/core/dev.c:7945)
  handle_softirqs (kernel/softirq.c:622)

## Affected

- `linux_kernel >= 2.6.31, < 5.10.258`
- `linux_kernel >= 5.11, < 5.15.209`
- `linux_kernel >= 5.16, < 6.1.175`
- `linux_kernel >= 6.2, < 6.6.141`
- `linux_kernel >= 6.7, < 6.12.91`
- `linux_kernel >= 6.13, < 6.18.33`
- `linux_kernel >= 6.19, < 7.0.10`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.10`