CVE-2026-43024

Vulnerability

Overview

CVE-2026-43024 affects the Linux kernel's netfilter subsystem, specifically the nf_tables module. The vulnerability arises because the code accepts an immediate `NF_QUEUE verdict even when the underlying protocol family, such as ARP, does not support packet queueing. The userspace nftables tool never emits such an immediate verdict, but a crafted or malicious rule set could trigger it, leading to unexpected behavior [1][2].

Attack

Vector

An attacker with the ability to load custom nftables rules (typically requiring root privileges or the CAP_NET_ADMIN capability) can inject an immediate NF_QUEUE verdict into an nftables rule. While the immediate verdict is not produced by legitimate nftables tools, the kernel does not block it, and when used with an ARP family table, the lack of queue support results in a reachable inconsistency [3].

Impact

Triggering the immediate NF_QUEUE verdict in the ARP family may cause the kernel to attempt to route a packet, but since there is no queue handler, the kernel could hit an error path or an uninitialized state. The precise impact depends on the kernel version and configuration, but it can lead to denial of service or undefined behavior. Because the capability requirement is high, the overall severity is rated Medium (CVSS 5.5) [4].

Mitigation

The fix globally rejects any immediate NF_QUEUE verdict in nf_tables, preventing the dangerous code path from being reached. The patch has been applied to the stable kernel branches; users should update to the latest kernel versions that include the commit [1][2][3][4].