The vulnerability in the Linux kernel's netfilter nft_inner_parse_l2l3() function arises because, when processing inner IPv6 packets, the function ipv6_find_hdr() correctly computes the transport header offset by traversing all extension headers. However, this correct offset is immediately overwritten with a value that only accounts for the IPv6 base header length (40 bytes). This causes a desynchronization between the inner_thoff (which points incorrectly to the extension header start) and the l4proto (which remains correct), enabling transport header forgery and potential firewall bypass. The normal IPv6 path preserves the correct offset, but the inner packet processing path did not, which is now fixed by removing the incorrect overwrite. The vulnerability is tracked as CVE-2026-46244 and has a CVSS 3.1 score of 9.1 (critical). Red Hat advisories RHSA-2026:33215 and RHSA-2026:34094 provide patches for Red Hat Enterprise Linux 9.6 and 10.0 Extended Update Support versions. The fix requires a system reboot to take effect.

The vulnerability allows an attacker to forge transport headers in inner IPv6 packets due to the desynchronization of the transport header offset. This can lead to firewall bypass, potentially allowing unauthorized network traffic to pass through filtering mechanisms. The CVSS score of 9.1 indicates a critical impact with high confidentiality and integrity impact and no required privileges or user interaction for exploitation. There are no known exploits in the wild at the time of this advisory.

Red Hat has released official security updates for Red Hat Enterprise Linux 9.6 and 10.0 Extended Update Support that address this vulnerability. Users should apply these kernel updates as soon as possible. After applying the update, a system reboot is required for the fix to take effect. Patch status is confirmed by the vendor advisories. No additional mitigations are specified beyond applying the official fixes.