CVE-2026-43025

Root

Cause

In the Linux kernel's netfilter subsystem, the function ctnetlink_create_expect in ctnetlink allowed userspace to specify a helper via CTA_EXPECT_HELP_NAME when creating an expectation. This helper differs from the master conntrack helper, leading to a validation mismatch. The issue was uncovered when CTA_EXPECT_CLASS was validated against the userspace-supplied helper, causing a slab-out-of-bounds read in nf_ct_expect_related_report, as shown in the KASAN report [1].

Exploitation

An attacker with the ability to send crafted netlink messages (requires CAP_NET_ADMIN) can supply) to the NFNL_SUBSYS_CTNETLINK subsystem can supply a helper name that differs from the master conntrack helper. This triggers an out-of-bounds memory read, allowing the attacker to read bytes beyond the expectation boundary [2].

Impact

A successful exploit results in reading kernel heap memory outside the allocated expectation structure, potentially leaking sensitive information. The CVSS v3 score of 7.3 indicates a high severity due to the potential for information disclosure [3].

Mitigation

The fix, backported to stable kernels, simply ignores the userspace-supplied helper name when creating expectations, mandating the use of the master conntrack helper. CTA_EXPECT_HELP_NAME is still used for dumping helper names to userspace, so no functionality is lost. Patches are available from the kernel stable tree [4].