CVE-2026-97417
High
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped. This matches the existing get_unaligned_be32() use later in the same function.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Linux
PublishedSep 24, 2026
First seenSep 24, 2026
How to fix
Update
- Linux Linux740ad3d17a281f7764dda4dbeb37cea52e2e31ae, a0523267de2523522b0f70972dd1ffa22ec6176c, 55bcc3376cd7b18954cc9814da697504fdaf12bf, 0d5ad732e4fdc569eb85861115e8f7b4c2c67852, 7ecfa46a536578a7ed335ddf31a854127268c27c, 4abc1af7ac209c066f4e5dd75cdd56876e5829a9, d3bf9eae486490832bd08fd62ab0ac601f346bd4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 ≤ v < 740ad3d17a281f7764dda4dbeb37cea52e2e31ae, bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 ≤ v < a0523267de2523522b0f70972dd1ffa22ec6176c, bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 ≤ v < 55bcc3376cd7b18954cc9814da697504fdaf12bf, bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 ≤ v < 0d5ad732e4fdc569eb85861115e8f7b4c2c67852, bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 ≤ v < 7ecfa46a536578a7ed335ddf31a854127268c27c, bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 ≤ v < 4abc1af7ac209c066f4e5dd75cdd56876e5829a9, bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 ≤ v < d3bf9eae486490832bd08fd62ab0ac601f346bd4, 3.1 | 740ad3d17a281f7764dda4dbeb37cea52e2e31ae, a0523267de2523522b0f70972dd1ffa22ec6176c, 55bcc3376cd7b18954cc9814da697504fdaf12bf, 0d5ad732e4fdc569eb85861115e8f7b4c2c67852, 7ecfa46a536578a7ed335ddf31a854127268c27c, 4abc1af7ac209c066f4e5dd75cdd56876e5829a9, d3bf9eae486490832bd08fd62ab0ac601f346bd4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.