CVE-2004-0626: The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6, when using iptables and TCP op...

Security readout for executives and security teams

CVE-2004-0626 is a remote denial-of-service flaw in the Linux 2.6 kernel netfilter code. Systems using iptables TCP options rules could be forced into excessive CPU consumption, potentially disrupting firewalling or host availability. It is old, configuration-dependent, and no active exploitation is cited in the provided sources. Exposure is most plausible on legacy Linux 2.6 systems using iptables rules that inspect TCP options. Modern systems are unlikely to be affected unless they run similarly old kernels or inherited vulnerable vendor packages. Treat this as a legacy exposure check, not a broad emergency. Prioritize if any internet-facing or security-control systems still run Linux 2.6 with iptables TCP options inspection. Mitigation focus: Identify any Linux 2.6 systems still operating in production.; Review whether iptables rules inspect TCP options on those systems.; Check the cited vendor advisories for fixed kernel packages..

Prepared

Jun 30, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.