CyberSecBulletin
CVE-2026-23397NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-23397 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e9cf17b91e733fec725ebcc0b3098bc5ccd505e0, 3c11b5c2436a3a5b450612ab160e3a525b28cfb5, aa0574182c46963c3cdb8cde46ec93aca21100d8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to e9cf17b91e733fec725ebcc0b3098bc5ccd505e0 or 3c11b5c2436a3a5b450612ab160e3a525b28cfb5 or aa0574182c46963c3cdb8cde46ec93aca21100d8 or 224f4678812e1a7bc8341bcb666773a0aec5ea6f, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.167 or 6.6.130, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, e9cf17b91e733fec725ebcc0b3098bc5ccd505e0; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, 3c11b5c2436a3a5b450612ab160e3a525b28cfb5; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, aa0574182c46963c3cdb8cde46ec93aca21100d8; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, 224f4678812e1a7bc8341bcb666773a0aec5ea6f; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, ec8bf0571b142f29dc0b68ae2ac3952f7a464b38; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, 3932620c04c2938c93c0890c225960d3d34ba355; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, 4c6aa008b913e808c4f4d3cde36cb1d9bb5967c6; 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 up to, but not including, dbdfaae9609629a9569362e3b8f33d0a20fd783c; and 1 more rangese9cf17b91e733fec725ebcc0b3098bc5ccd505e0, 3c11b5c2436a3a5b450612ab160e3a525b28cfb5, aa0574182c46963c3cdb8cde46ec93aca21100d8, 224f4678812e1a7bc8341bcb666773a0aec5ea6f, ec8bf0571b142f29dc0b68ae2ac3952f7a464b38, 3932620c04c2938c93c0890c225960d3d34ba355
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
LinuxLinux Kernel2.6.31.1 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.20; 6.19 up to, but not including, 6.19.10; 2.6.31; and 1 more ranges5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter the option matching loop even when foptsize sums to zero, which matches packets with no TCP options where ctx->optp is NULL: Oops: general protection fault KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: nf_osf_match (net/netfilter/nfnetlink_osf.c:227) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:293) nf_hook_slow (net/netfilter/core.c:623) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) Additionally, an MSS option (kind=2) with length < 4 causes out-of-bounds reads when nf_osf_match_one() unconditionally accesses optp[2] and optp[3] for MSS value extraction. While RFC 9293 section 3.2 specifies that the MSS option is always exactly 4 bytes (Kind=2, Length=4), the check uses "< 4" rather than "!= 4" because lengths greater than 4 do not cause memory safety issues -- the buffer is guaranteed to be at least foptsize bytes by the ctx->optsize == foptsize check. Reject fingerprints where any option has zero length, or where an MSS option has length less than 4, at add time rather than trusting these values in the packet matching hot path.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.