$ research-item --score 33 --exploit none

In the Linux kernel, the following vulnerability has been resolved:

netfilte…

Research page generated from configured evidence sources. Treat this as an analyst workbench: facts are sourced, gaps are labelled, and low-confidence chatter is separated from confirmed evidence.

Executive judgement

  • Operational lane: monitor
  • Priority score: 33
  • Confidence: medium
  • Exploit status: none — No public exploitation signal captured by the configured pipeline yet.
  • Urgent publishable: no
  • CISA KEV: No CISA KEV match captured in configured source data at generation time.
  • Published/observed: 2026-06-03
  • EPSS score: not available

What happened

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: Fix IPv6 inner_thoff desync

In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2.

For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()’s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()’s calculated transport header offset is preserved, thereby fixing the desynchronization.

Why it matters

  • The item was promoted because the pipeline observed: priority score 33, exploit status none, confidence medium.
  • It has a CVE identifier, so it can be tracked across NVD/CVE.org/vendor/exploit sources.
  • No PoC signal was detected by the current pipeline unless shown elsewhere on this page.

Evidence collected

Exploitation and PoC status

  • Current automated assessment: No public exploitation signal captured by the configured pipeline yet.
  • Public exploit/PoC: No PoC source captured yet by the configured pipeline.
  • Exploited in the wild: Not confirmed by configured sources at generation time.
  • Ransomware association: No ransomware association captured at generation time.

Publication / validation flags

  • no_exploitation_signal

Dark web / low-confidence chatter

  • No matching OTX/URLhaus/MalwareBazaar item found in configured low-confidence feeds at generation time.
  • This is not proof of absence. It means the current automated sources did not capture relevant underground or malware-feed chatter.

Defender actions

  • Update Linux kernel with nft_inner fix applied
  • Audit nftables rules using inner IPv6 matching
  • Test IPv6 extension header filtering post-update

Analyst note

Priority 33/100 and complete absence of KEV or exploit signals show limited operational urgency. The root cause was overwriting ipv6_find_hdr() result with a fixed 40-byte offset. Apply via normal kernel patching cadence.

Defender / Sentinel hunting queries

MDE exposure: devices with CVE-2026-46244

Find devices where Microsoft Defender Vulnerability Management reports the CVE.

DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-46244"
| project DeviceName, OSPlatform, SoftwareVendor, SoftwareName, SoftwareVersion, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, LastSeenTime
| order by VulnerabilitySeverityLevel desc, LastSeenTime desc

MDE edge/service exploitation telemetry triage

Look for unusual network/process activity around exposed edge, OT, or management services. Tune product terms before operational use.

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemotePort in (443, 8443, 9443, 8080, 8000, 5000) or LocalPort in (443, 8443, 9443, 8080, 8000, 5000)
| where RemoteUrl has "Linux" or InitiatingProcessCommandLine has "Linux" or AdditionalFields has "Linux" or RemoteUrl has "kernel" or InitiatingProcessCommandLine has "kernel" or AdditionalFields has "kernel" or RemoteUrl has "following" or InitiatingProcessCommandLine has "following" or AdditionalFields has "following" or RemoteUrl has "been" or InitiatingProcessCommandLine has "been" or AdditionalFields has "been" or RemoteUrl has "resolved" or InitiatingProcessCommandLine has "resolved" or AdditionalFields has "resolved" or RemoteUrl has "CVE-2026-46244" or AdditionalFields has "CVE-2026-46244"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, LocalPort, ActionType, AdditionalFields
| order by Timestamp desc

MDE endpoint behaviour hunt

General endpoint hunt for named tooling, malware, or exploit artefacts from the research item. Tune terms with vendor IOCs.

DeviceProcessEvents
| where Timestamp > ago(14d)
| where ProcessCommandLine has "Linux" or FileName has "Linux" or FolderPath has "Linux" or ProcessCommandLine has "kernel" or FileName has "kernel" or FolderPath has "kernel" or ProcessCommandLine has "following" or FileName has "following" or FolderPath has "following" or ProcessCommandLine has "been" or FileName has "been" or FolderPath has "been" or ProcessCommandLine has "resolved" or FileName has "resolved" or FolderPath has "resolved"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

MDE file artefact hunt

Hunt for suspicious files dropped or modified during exploitation of this vulnerability.

DeviceFileEvents
| where Timestamp > ago(14d)
| where FileName has "Linux" or FolderPath has "Linux" or InitiatingProcessCommandLine has "Linux" or FileName has "kernel" or FolderPath has "kernel" or InitiatingProcessCommandLine has "kernel" or FileName has "following" or FolderPath has "following" or InitiatingProcessCommandLine has "following" or FileName has "been" or FolderPath has "been" or InitiatingProcessCommandLine has "been" or FileName has "resolved" or FolderPath has "resolved" or InitiatingProcessCommandLine has "resolved"
| project Timestamp, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, FileSize
| order by Timestamp desc

Exposure validation ideas

  • Search asset inventory for affected vendor/product names and any CVE reference.
  • Check internet-facing exposure through approved tools only: Shodan/Censys/GreyNoise links below are research starting points, not proof of exposure.
  • Prioritise management interfaces, edge devices, identity/control-plane systems, and OT/ICS assets where relevant.

Detection / hunting ideas

  • Review vendor logs for authentication failures, privilege changes, unexpected admin activity, and anomalous management-plane access.
  • Search SIEM/EDR telemetry for product-specific process names, network services, and newly published indicators from primary sources.
  • Monitor for scanner traffic or nuclei/metasploit module references once public exploit tooling appears.

Open questions

  • Is there a primary vendor advisory with exact affected versions and fixed versions?
  • Has CISA KEV, Shadowserver, GreyNoise, or a trusted vendor confirmed exploitation?
  • Are there credible PoC repositories or only secondary reporting mentioning PoC?
  • Is there underground/forum/leak-site discussion, or only public reporting?

Generated: 2026-06-17T11:10:55+00:00

← back to today