[SRU][Q][PATCH 0/1] CVE-2026-52999

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-52999

[ Impact ]

In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed
by reference to nf_osf_match_one() for each fingerprint checked. During TCP
option parsing, nf_osf_match_one() advances the shared ctx->optp pointer
without restoring it after an early return on a perfect match. When
NF_OSF_LOGLEVEL_ALL is configured, subsequent fingerprint checks start parsing
from the end of the options buffer, causing an out-of-bounds read of garbage
data. This results in incorrect or missing match logging.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in the netfilter nfnetlink_osf module could affect OS fingerprint
matching, potentially causing incorrect passive OS detection results or
breaking connections filtered by osf rules.