CVE-2026-80637

The Linux kernel's netfilter SYNPROXY module reads and writes TCP timestamp option fields with plain 32-bit accesses, so TCP packets carrying timestamp options at unaligned offsets trigger unaligned memory access during timestamp parsing and adjustment. A remote attacker who can send TCP traffic to a service or firewall protected by SYNPROXY rules can hit this code path without needing credentials or user interaction. On strict-alignment architectures (e.g., ARM, MIPS, PowerPC, SPARC) the unaligned access can crash the kernel, while on other platforms it causes performance degradation, yielding a remote denial of service with availability-only impact (CVSS 7.5). Any Linux deployment that actively uses SYNPROXY in its iptables/nftables rules is affected; the advisory does not specify affected kernel version ranges. No public proof-of-concept, CISA KEV listing, or observed exploitation is known, and EPSS estimates about a 0.4% probability of exploitation within 30 days.

What to do: Apply a kernel update that includes the synproxy unaligned-access fix (the commit switching to get_unaligned_be32()/put_unaligned_be32()) once available for your distribution. Meanwhile, check whether SYNPROXY is in use by inspecting iptables/nftables rules for the synproxy target, and if it is, restrict which clients can reach those services or consider removing SYNPROXY rules on strict-alignment platforms until patched. Prioritize ARM, MIPS, PowerPC and SPARC systems, where the impact is a kernel crash rather than only performance loss.