From: Sung Byeongchan The DCCP UAPI defines option numbers 3 through 31 as reserved. Like Padding and Mandatory, these options occupy one byte. dccp_find_option() only treats values below 2 as single-byte and interprets the byte after a reserved option as a TLV length. This can skip a later option and invert an XT_DCCP_OPTION rule result. A local production-hook fixture installed the same DROP rule for IPv4 and IPv6. In three fresh boots per kernel, a target-only packet was dropped 20/20 times, while adding reserved option 3 before the same target let 20/20 packets reach the protected receiver. The fixed kernel dropped all trigger packets in three fresh boots and preserved the normal controls. Treat every option up to DCCPO_MAX_RESERVED as single-byte, matching the protocol definition. Triggering requires CONFIG_NETFILTER_XTABLES_LEGACY, CONFIG_NETFILTER_XT_MATCH_DCCP, an option-based rule, and remote protocol-33 reachability. The touched source is unchanged at 0c2669a9f4a1d607e7591ae50ccf3c432a0aff08, where the patch applies and builds cleanly. The demonstrated impact is a conditional remote filter-verdict bypass. No memory-safety violation, information disclosure, RCE, or LPE was demonstrated. The source reproducer and complete logs are available on request and are not included in this public report. OpenAI Codex assisted source inspection, test design, patch drafting, and evidence organization. Fixes: 1d3de414eb20 ("[NETFILTER]: New iptables DCCP protocol header match") Assisted-by: LLM Signed-off-by: Sung Byeongchan --- net/netfilter/xt_dccp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c index 3db81e041af9b..23a4e3e8df7de 100644 --- a/net/netfilter/xt_dccp.c +++ b/net/netfilter/xt_dccp.c @@ -62,7 +62,7 @@ dccp_find_option(u_int8_t option, return true; } - if (op[i] < 2 || i == optlen - 1) + if (op[i] <= DCCPO_MAX_RESERVED || i == optlen - 1) i++; else i += op[i + 1] ? : 1; -- 2.43.0