Fernando Fernandez ManceraandGreg Kroah-Hartman fc2900a908 netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures ...

[ Upstream commit a625c94144 ]

The MSS calculation in nf_osf_match_one() manually shifts bytes to
construct a 16-bit value before passing it to ntohs().

This works on little-endian hosts but it does not work on big-endian as
the bytes are being always shifted and set in the same way for all
architectures.

Use get_unaligned_be16() to fix this on big-endian systems. It also
simplifies the code.

Fixes: 11eeef41d5 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-07-24 15:54:38 +02:00

..

6lowpan

6lowpan: fix NHC entry use-after-free on error path

2026-07-24 15:54:21 +02:00

9p

9p: avoid putting oldfid in p9_client_walk() error path

2026-07-04 13:41:32 +02:00

802

net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

2026-06-19 13:37:10 +02:00

8021q

…

appletalk

…

atm

atm: lec: fix use-after-free in sock_def_readable()

2026-04-11 14:16:18 +02:00

ax25

…

batman-adv

batman-adv: tvlv: avoid race of cifsnotfound handler state

2026-07-04 13:41:30 +02:00

bluetooth

Bluetooth: L2CAP: validate option length before reading conf opt value

2026-07-24 15:54:23 +02:00

bpf

bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb

2026-06-01 17:39:08 +02:00

bpfilter

…

bridge

netfilter: ebtables: terminate table name before find_table_lock()

2026-07-24 15:54:23 +02:00

caif

net: caif: clear client service pointer on teardown

2026-06-01 17:38:45 +02:00

can

can: raw: fix ro->uniq use-after-free in raw_rcv()

2026-06-01 17:38:35 +02:00

ceph

libceph: handle rbtree insertion error in decode_choose_args()

2026-06-01 17:39:33 +02:00

core

net: Drop the lock in skb_may_tx_timestamp()

2026-07-24 15:54:23 +02:00

dcb

…

dccp

…

devlink

…

dns_resolver

…

dsa

net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths

2026-07-24 15:54:31 +02:00

ethernet

…

ethtool

ethtool: eeprom: add more safeties to EEPROM Netlink fallback

2026-06-19 13:36:54 +02:00

hsr

net: hsr: defer node table free until after RCU readers

2026-06-19 13:37:26 +02:00

ieee802154

ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

2026-06-19 13:37:10 +02:00

ife

…

ipv4

ipv4: account for fraggap on the paged allocation path

2026-07-24 15:54:30 +02:00

ipv6

ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

2026-07-24 15:54:34 +02:00

iucv

net/iucv: fix locking in .getsockopt

2026-06-19 13:36:54 +02:00

kcm

…

key

net: af_key: initialize alg_key_len for IPComp states

2026-07-24 15:54:22 +02:00

l2tp

l2tp: Drop large packets with UDP encap

2026-06-01 17:38:35 +02:00

l3mdev

…

lapb

…

llc

…

mac80211

wifi: mac80211: remove station if connection prep fails

2026-06-19 13:37:21 +02:00

mac802154

mac802154: llsec: add skb_cow_data() before in-place crypto

2026-07-04 13:41:31 +02:00

mctp

net: mctp: fix don't require received header reserved bits to be zero

2026-06-19 13:37:20 +02:00

mpls

…

mptcp

mptcp: fix missing wakeups in edge scenarios

2026-07-04 13:41:32 +02:00

ncsi

…

netfilter

netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures

2026-07-24 15:54:38 +02:00

netlabel

netlabel: validate unlabeled address and mask attribute lengths

2026-06-19 13:37:11 +02:00

netlink

genetlink: Use internal flags for multicast groups

2026-06-19 13:37:25 +02:00

netrom

…

nfc

nfc: hci: fix out-of-bounds read in HCP header parsing

2026-06-19 13:37:02 +02:00

nsh

…

openvswitch

net: openvswitch: fix possible kfree_skb of ERR_PTR

2026-06-19 13:37:11 +02:00

packet

net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

2026-06-19 13:36:57 +02:00

phonet

net: phonet: free phonet_device after RCU grace period

2026-07-04 13:41:33 +02:00

psample

genetlink: Use internal flags for multicast groups

2026-06-19 13:37:25 +02:00

qrtr

net: qrtr: ns: Limit the total number of nodes

2026-06-19 13:37:20 +02:00

rds

net: rds: clear i_sends on setup unwind

2026-06-19 13:37:16 +02:00

rfkill

net: rfkill: prevent unlimited numbers of rfkill events from being created

2026-04-18 10:35:57 +02:00

rose

…

rxrpc

rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

2026-06-01 17:38:43 +02:00

sched

net/sched: cls_bpf: prevent unbounded recursion in offload rollback

2026-07-24 15:54:36 +02:00

sctp

sctp: stream: fully roll back denied add-stream state

2026-06-19 13:37:17 +02:00

smc

net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS

2026-06-19 13:37:07 +02:00

strparser

net: strparser: fix skb_head leak in strp_abort_strp()

2026-06-01 17:38:45 +02:00

sunrpc

…

switchdev

…

tipc

tipc: fix out-of-bounds read in broadcast Gap ACK blocks

2026-07-24 15:54:21 +02:00

tls

net: skmsg: preserve sg.copy across SG transforms

2026-07-04 13:41:31 +02:00

unix

af_unix: Reject SIOCATMARK on non-stream sockets

2026-07-04 13:41:28 +02:00

vmw_vsock

vsock/vmci: fix sk_ack_backlog leak on failed handshake

2026-06-19 13:37:15 +02:00

wireless

wifi: cfg80211: fix grammar in MLO group key error message

2026-07-24 15:54:32 +02:00

x25

net/x25: Fix overflow when accumulating packets

2026-04-11 14:16:24 +02:00

xdp

xsk: tighten UMEM headroom validation to account for tailroom and min frame

2026-06-01 17:38:34 +02:00

xfrm

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

2026-06-19 13:37:21 +02:00

compat.c

…

devres.c

…

Kconfig

…

Kconfig.debug

…

Makefile

…

socket.c

net: Drop the lock in skb_may_tx_timestamp()

2026-07-24 15:54:23 +02:00

sysctl_net.c

…