ACK: [SRU][Q][PATCH 0/1] CVE-2026-52999

[Tim Whisonant]

On Thu, Jul 16, 2026 at 05:25:58PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52999
> 
> [ Impact ]
> 
> In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed
> by reference to nf_osf_match_one() for each fingerprint checked. During TCP
> option parsing, nf_osf_match_one() advances the shared ctx->optp pointer
> without restoring it after an early return on a perfect match. When
> NF_OSF_LOGLEVEL_ALL is configured, subsequent fingerprint checks start parsing
> from the end of the options buffer, causing an out-of-bounds read of garbage
> data. This results in incorrect or missing match logging.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> focal: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression in the netfilter nfnetlink_osf module could affect OS fingerprint
> matching, potentially causing incorrect passive OS detection results or
> breaking connections filtered by osf rules.
> 

Acked-by: Tim Whisonant <tim.whisonant at canonical.com>