VulnerabilityPublished 8 May 2026Updated 6 Nov 2026

CVE-2026-43451: Linux kernel · netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f1ba83755d81c6fc66ac7acd723d238f974091e9 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f1ba83755d81c6fc66ac7acd723d238f974091e9, cf4a4df38d1747e06fc54f9879bd7a6f4178032f, b38d2b4603fd3dda24eb8b3dd81c18a0930be97b +5

Exploitation evidence

Disclosed: evidence found.
CVE published 8 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8d45ff22f1b43249f0cf1baafe0262ca10d1666e, < f1ba83755d81c6fc66ac7acd723d238f974091e9	Fixed in f1ba83755d81c6fc66ac7acd723d238f974091e9
LinuxLinux	Affected ≥ 8d45ff22f1b43249f0cf1baafe0262ca10d1666e, < cf4a4df38d1747e06fc54f9879bd7a6f4178032f	Fixed in cf4a4df38d1747e06fc54f9879bd7a6f4178032f
LinuxLinux	Affected ≥ 8d45ff22f1b43249f0cf1baafe0262ca10d1666e, < b38d2b4603fd3dda24eb8b3dd81c18a0930be97b	Fixed in b38d2b4603fd3dda24eb8b3dd81c18a0930be97b
LinuxLinux	Affected ≥ 8d45ff22f1b43249f0cf1baafe0262ca10d1666e, < a907bea273b60d3e604ec4e8e1f6c49954805794	Fixed in a907bea273b60d3e604ec4e8e1f6c49954805794
LinuxLinux	Affected ≥ 8d45ff22f1b43249f0cf1baafe0262ca10d1666e, < 208669df703a25a601f45822b10c413f258bf275	Fixed in 208669df703a25a601f45822b10c413f258bf275
LinuxLinux	Affected ≥ 8d45ff22f1b43249f0cf1baafe0262ca10d1666e, < 9853d94b82d303fc4ac37d592a23a154096ecd41	Fixed in 9853d94b82d303fc4ac37d592a23a154096ecd41

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff. This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory. Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.

References

Community reviews

Loading reviews…