CVE-2026-43450: Linux kernel · netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 92441f6d9405a0c18d03f278b395e782f79a4a30 : update Linux kernel when convenient.
Data as of 6 Nov 2026, 16:04 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in 92441f6d9405a0c18d03f278b395e782f79a4a30, 05018cd9370f77bb18fbf6e15ff33c7a06f10b3c, 894c5780ddadd5fde0e16f66587918e6be1504c4 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 8 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0
References
- git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf (opens in a new tab)
- git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30 (opens in a new tab)
- git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e (opens in a new tab)
- git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da (opens in a new tab)
- git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4 (opens in a new tab)
- git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c (opens in a new tab)
- git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db (opens in a new tab)
- git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89 (opens in a new tab)