CVE-2026-45841

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlinkosf: fix divide-by-zero in OSFWSS_MODULO

nfosfmatchone() computes ctx->window % f->wss.val in the OSFWSSMODULO branch with no guard for f->wss.val == 0. A CAPNET_ADMIN user can add such a fingerprint via nfnetlink; a subsequent matching TCP SYN divides by zero and panics the kernel.

Reject the bogus fingerprint in nfnlosfaddcallback() above the per-option for-loop. f->wss is per-fingerprint, not per-option, so the check must run regardless of f->optnum (including 0). Also reject wss.wc >= OSFWSSMAX; nfosfmatch_one() already treats that as "should not happen".

Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:nfosfmatchone (net/netfilter/nfnetlinkosf.c:98) Call Trace: <IRQ> nfosfmatch (net/netfilter/nfnetlinkosf.c:220) xtosfmatchpacket (net/netfilter/xtosf.c:32) iptdotable (net/ipv4/netfilter/iptables.c:348) nfhookslow (net/netfilter/core.c:622) iplocaldeliver (net/ipv4/ipinput.c:265) iprcv (include/linux/skbuff.h:1162) __netifreceiveskb_onecore (net/core/dev.c:6181) processbacklog (net/core/dev.c:6642) __napipoll (net/core/dev.c:7710) netrxaction (net/core/dev.c:7945) handlesoftirqs (kernel/softirq.c:622)