CVE-2026-43190

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_tcpmss: check remaining length before reading optlen

Quoting reporter:

In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads

op[i+1] directly without validating the remaining option length.

If the last byte of the option field is not EOL/NOP (0/1), the code attempts

to index op[i+1]. In the case where i + 1 == optlen, this causes an

out-of-bounds read, accessing memory past the optlen boundary

(either reading beyond the stack buffer _opt or the

following payload).