{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80637","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.777Z","datePublished":"2026-08-28T06:48:50.836Z","dateUpdated":"2026-08-29T06:21:36.886Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-29T06:21:36.886Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\n\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\nwrite the timestamp fields. This prevents performance degradation due to\nunaligned memory access or even a crash on strict alignment\narchitectures.\n\nThis follows the implementation of timestamp parsing in the networking\nstack at tcp_parse_options() and synproxy_parse_options()."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - synproxy_tstamp_adjust() runs in ipv4/ipv6_synproxy_hook on received TCP segments after SYNPROXY handshake; internet-facing gateways with SYNPROXY enabled process attacker-crafted inbound packets, matching CNA precedent for remote synproxy packet bugs.\nAC:L - Once SYNPROXY with timestamps is active and tsoff is set, the attacker fully controls TCP option layout and can reliably place TCPOPT_TIMESTAMP so op[2]/op[6] are 2-mod-4 unaligned (e.g. MSS+SACK_PERM+two NOPs+TIMESTAMP), deterministically hitting the misaligned __be32 access.\nPR:N - Exploitation requires only sending TCP traffic to a host where an administrator already enabled SYNPROXY/nftables synproxy with timestamps; the remote attacker needs no local account, capability, or authentication on the target.\nUI:N - The netfilter hook processes matching TCP segments automatically during normal connection handling; no victim user action beyond routine network connectivity to the protected service is required.\nS:U - An alignment fault in synproxy timestamp adjustment panics or oopses the host kernel but does not cross VM, container, IOMMU, or other security boundaries; impact remains within the same kernel authority.\nC:N - The flaw is misaligned load/store of the packet's own TCP timestamp fields inside the skb buffer, not an out-of-bounds or use-after-free read of kernel memory; on strict-alignment architectures it faults immediately without disclosing attacker-inaccessible data.\nI:N - No kernel metadata or adjacent structures are corrupted; the write only adjusts the intended timestamp value in the TCP option bytes, and strict-alignment targets fault before any unintended modification can occur.\nA:H - The commit and fault mechanism confirm that direct misaligned __be32 dereference on strict-alignment architectures (e.g. SPARC, some ARM) causes a kernel alignment fault/oops/panic, fully denying availability on SYNPROXY-protected gateways and embedded routers."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_synproxy_core.c"],"versions":[{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","lessThan":"2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4","status":"affected","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","lessThan":"5c9c67cf7a3d16051dfb90e98836f530964dfb8e","status":"affected","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","lessThan":"ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7","status":"affected","versionType":"git"},{"version":"48b1de4c110a7afa4b85862f6c75af817db26fad","lessThan":"992c20bc8a4aba220c8b95b467d049289778dad6","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_synproxy_core.c"],"versions":[{"version":"3.12","status":"affected"},{"version":"0","lessThan":"3.12","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4"},{"url":"https://git.kernel.org/stable/c/5c9c67cf7a3d16051dfb90e98836f530964dfb8e"},{"url":"https://git.kernel.org/stable/c/ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7"},{"url":"https://git.kernel.org/stable/c/992c20bc8a4aba220c8b95b467d049289778dad6"}],"title":"netfilter: synproxy: fix unaligned memory access in timestamp adjustment","x_generator":{"engine":"bippy-1.2.0"}}}}