Medium 5.5Published May 27, 2026

CVE-2026-45841netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

Updated under an hour ago (2026-10-19 07:50 UTC)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO nf_osf_match_one() computes ctx->window % f->wss.val in the OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a subsequent matching TCP SYN divides by zero and panics the kernel. Reject the bogus fingerprint in nfnl_osf_add_callback() above the per-option for-loop. f->wss is per-fingerprint, not per-option, so the check must run regardless of f->opt_num (including 0). Also reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that as "should not happen". Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: <IRQ> nf_osf_match (net/netfilter/nfnetlink_osf.c:220) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:348) nf_hook_slow (net/netfilter/core.c:622) ip_local_deliver (net/ipv4/ip_input.c:265) ip_rcv (include/linux/skbuff.h:1162) __netif_receive_skb_one_core (net/core/dev.c:6181) process_backlog (net/core/dev.c:6642) __napi_poll (net/core/dev.c:7710) net_rx_action (net/core/dev.c:7945) handle_softirqs (kernel/softirq.c:622)

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 before cb833bbc1b3c51e08652d3c86298307c07d3f2db; from 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 before 26900306a5a2c3e4f75c643a064525526bb6e5f3; from 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 before 0694618cf3e9b120666e31f5f383a6e466d95a0d; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 builds before 8def8fbd23f40e945febe913d04b731012ce0082; from 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 before c55940895245d8ef658ab381248a28755218d625; from 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 before fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 builds before 9a05e195618a6d474f2bcd5b6376d0ffc2f00366; from 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 before 2195574dc6d9017d32ac346987e12659f931d932	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.31 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

https://git.kernel.org/stable/c/cb833bbc1b3c51e08652d3c86298307c07d3f2dbpatch
https://git.kernel.org/stable/c/26900306a5a2c3e4f75c643a064525526bb6e5f3patch
https://git.kernel.org/stable/c/0694618cf3e9b120666e31f5f383a6e466d95a0dpatch
https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082patch
https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625patch
https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2fpatch
https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366patch
https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.