{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80637", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.777Z", "datePublished": "2026-08-28T06:48:50.836Z", "dateUpdated": "2026-08-29T06:21:36.886Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:21:36.886Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\n\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\nwrite the timestamp fields. This prevents performance degradation due to\nunaligned memory access or even a crash on strict alignment\narchitectures.\n\nThis follows the implementation of timestamp parsing in the networking\nstack at tcp_parse_options() and synproxy_parse_options()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - synproxy_tstamp_adjust() runs in ipv4/ipv6_synproxy_hook on received TCP segments after SYNPROXY handshake; internet-facing gateways with SYNPROXY enabled process attacker-crafted inbound packets, matching CNA precedent for remote synproxy packet bugs.\nAC:L - Once SYNPROXY with timestamps is active and tsoff is set, the attacker fully controls TCP option layout and can reliably place TCPOPT_TIMESTAMP so op[2]/op[6] are 2-mod-4 unaligned (e.g. MSS+SACK_PERM+two NOPs+TIMESTAMP), deterministically hitting the misaligned __be32 access.\nPR:N - Exploitation requires only sending TCP traffic to a host where an administrator already enabled SYNPROXY/nftables synproxy with timestamps; the remote attacker needs no local account, capability, or authentication on the target.\nUI:N - The netfilter hook processes matching TCP segments automatically during normal connection handling; no victim user action beyond routine network connectivity to the protected service is required.\nS:U - An alignment fault in synproxy timestamp adjustment panics or oopses the host kernel but does not cross VM, container, IOMMU, or other security boundaries; impact remains within the same kernel authority.\nC:N - The flaw is misaligned load/store of the packet's own TCP timestamp fields inside the skb buffer, not an out-of-bounds or use-after-free read of kernel memory; on strict-alignment architectures it faults immediately without disclosing attacker-inaccessible data.\nI:N - No kernel metadata or adjacent structures are corrupted; the write only adjusts the intended timestamp value in the TCP option bytes, and strict-alignment targets fault before any unintended modification can occur.\nA:H - The commit and fault mechanism confirm that direct misaligned __be32 dereference on strict-alignment architectures (e.g. SPARC, some ARM) causes a kernel alignment fault/oops/panic, fully denying availability on SYNPROXY-protected gateways and embedded routers."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_synproxy_core.c"], "versions": [{"version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "lessThan": "2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4", "status": "affected", "versionType": "git"}, {"version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "lessThan": "5c9c67cf7a3d16051dfb90e98836f530964dfb8e", "status": "affected", "versionType": "git"}, {"version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "lessThan": "ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7", "status": "affected", "versionType": "git"}, {"version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "lessThan": "992c20bc8a4aba220c8b95b467d049289778dad6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_synproxy_core.c"], "versions": [{"version": "3.12", "status": "affected"}, {"version": "0", "lessThan": "3.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4"}, {"url": "https://git.kernel.org/stable/c/5c9c67cf7a3d16051dfb90e98836f530964dfb8e"}, {"url": "https://git.kernel.org/stable/c/ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7"}, {"url": "https://git.kernel.org/stable/c/992c20bc8a4aba220c8b95b467d049289778dad6"}], "title": "netfilter: synproxy: fix unaligned memory access in timestamp adjustment", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_synproxy_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4", "status": "affected", "version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "versionType": "git"}, {"lessThan": "5c9c67cf7a3d16051dfb90e98836f530964dfb8e", "status": "affected", "version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "versionType": "git"}, {"lessThan": "ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7", "status": "affected", "version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "versionType": "git"}, {"lessThan": "992c20bc8a4aba220c8b95b467d049289778dad6", "status": "affected", "version": "48b1de4c110a7afa4b85862f6c75af817db26fad", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_synproxy_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"lessThan": "3.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\n\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\nwrite the timestamp fields. This prevents performance degradation due to\nunaligned memory access or even a crash on strict alignment\narchitectures.\n\nThis follows the implementation of timestamp parsing in the networking\nstack at tcp_parse_options() and synproxy_parse_options()."}], "id": "CVE-2026-80637", "lastModified": "2026-08-29T07:16:47.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-28T08:16:48.620", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b8e7aaa38002d8ee2f48d87b1f392eadd8e98c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c9c67cf7a3d16051dfb90e98836f530964dfb8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/992c20bc8a4aba220c8b95b467d049289778dad6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea3d2caa5bfacf5db5c1cad521ca5d9144edd9a7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfilter: synproxy: fix unaligned memory access in timestamp adjustment", "id": "2525460", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525460"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-468", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: synproxy: fix unaligned memory access in timestamp adjustment\nUse get_unaligned_be32() and put_unaligned_be32() to safely read and\nwrite the timestamp fields. This prevents performance degradation due to\nunaligned memory access or even a crash on strict alignment\narchitectures.\nThis follows the implementation of timestamp parsing in the networking\nstack at tcp_parse_options() and synproxy_parse_options().", "A flaw was found in the Linux kernel's netfilter synproxy component. This vulnerability is due to unaligned memory access when adjusting timestamp fields. An attacker could potentially trigger this flaw by sending specially crafted network traffic, leading to performance degradation or a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-80637", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80637\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80637\nhttps://lore.kernel.org/linux-cve-announce/2026082840-CVE-2026-80637-4cf0@gregkh/T"], "threat_severity": "Moderate"}