VulnerabilityPublished 27 May 2026Updated 6 Nov 2026

CVE-2026-45844: Linux kernel · netfilter: arp_tables: fix IEEE1394 ARP payload parsing

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ad9973df8e0eeb123d9ec4d18828e05b7d44ff4b : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ad9973df8e0eeb123d9ec4d18828e05b7d44ff4b, ac698d81fd6619c7504cee913f1cab5285fba1b7, 84e8536c981338d0d8cc6e712cf71a936a93e13f +5

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6752c8db8e0cfedb44ba62806dd15b383ed64000, < ad9973df8e0eeb123d9ec4d18828e05b7d44ff4b	Fixed in ad9973df8e0eeb123d9ec4d18828e05b7d44ff4b
LinuxLinux	Affected ≥ 6752c8db8e0cfedb44ba62806dd15b383ed64000, < ac698d81fd6619c7504cee913f1cab5285fba1b7	Fixed in ac698d81fd6619c7504cee913f1cab5285fba1b7
LinuxLinux	Affected ≥ 6752c8db8e0cfedb44ba62806dd15b383ed64000, < 84e8536c981338d0d8cc6e712cf71a936a93e13f	Fixed in 84e8536c981338d0d8cc6e712cf71a936a93e13f
LinuxLinux	Affected ≥ 6752c8db8e0cfedb44ba62806dd15b383ed64000, < 03ea11dbefaa55c502735ee551c89ef773fe753b	Fixed in 03ea11dbefaa55c502735ee551c89ef773fe753b
LinuxLinux	Affected ≥ 6752c8db8e0cfedb44ba62806dd15b383ed64000, < 1e285362ef7096eb12733370d59e033f4a1d294a	Fixed in 1e285362ef7096eb12733370d59e033f4a1d294a
LinuxLinux	Affected ≥ 6752c8db8e0cfedb44ba62806dd15b383ed64000, < 1e8e3f449b1e73b73a843257635b9c50f0cc0f0a	Fixed in 1e8e3f449b1e73b73a843257635b9c50f0cc0f0a

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: arp_tables: fix IEEE1394 ARP payload parsing Weiming Shi says: "arp_packet_match() unconditionally parses the ARP payload assuming two hardware addresses are present (source and target). However, IPv4-over-IEEE1394 ARP (RFC 2734) omits the target hardware address field, and arp_hdr_len() already accounts for this by returning a shorter length for ARPHRD_IEEE1394 devices. As a result, on IEEE1394 interfaces arp_packet_match() advances past a nonexistent target hardware address and reads the wrong bytes for both the target device address comparison and the target IP address. This causes arptables rules to match against garbage data, leading to incorrect filtering decisions: packets that should be accepted may be dropped and vice versa. The ARP stack in net/ipv4/arp.c (arp_create and arp_process) already handles this correctly by skipping the target hardware address for ARPHRD_IEEE1394. Apply the same pattern to arp_packet_match()." Mangle the original patch to always return 0 (no match) in case user matches on the target hardware address which is never present in IEEE1394. Note that this returns 0 (no match) for either normal and inverse match because matching in the target hardware address in ARPHRD_IEEE1394 has never been supported by arptables. This is intentional, matching on the target hardware address should never evaluate true for ARPHRD_IEEE1394. Moreover, adjust arpt_mangle to drop the packet too as AI suggests: In arpt_mangle, the logic assumes a standard ARP layout. Because IEEE1394 (FireWire) omits the target hardware address, the linear pointer arithmetic miscalculates the offset for the target IP address. This causes mangling operations to write to the wrong location, leading to packet corruption. To ensure safety, this patch drops packets (NF_DROP) when mangling is requested for these fields on IEEE1394 devices, as the current implementation cannot correctly map the FireWire ARP payload. This omits both mangling target hardware and IP address. Even if IP address mangling should be possible in IEEE1394, this would require to adjust arpt_mangle offset calculation, which has never been supported. Based on patch from Weiming Shi <bestswngs@gmail.com>.

References

Community reviews

Loading reviews…