CVE-2026-43451

Vulnerability

In the Linux kernel's netfilter subsystem, the function nfqnl_recv_verdict() in nfnetlink_queue handles verdicts for queued packets. When processing a packet from a bridge (PF_BRIDGE), it calls find_dequeue_entry() to remove the entry from the queue, taking ownership. It then calls nfqa_parse_bridge() to parse VLAN attributes. If this parsing fails (e.g., NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its associated sk_buff. This leaks the nf_queue_entry, the socket buffer, and all held references (net_device refcounts, struct net refcount).

Exploitation

An attacker with local access or the ability to send crafted netfilter queue verdicts can repeatedly trigger this error path by supplying malformed bridge VLAN attributes. Each trigger leaks kernel memory, and repeated exploitation can exhaust available memory, leading to a denial of service. No authentication is required beyond the ability to interact with the nfnetlink_queue subsystem.

Impact

The vulnerability enables a local denial of service by exhausting kernel memory. There is no evidence of code execution or privilege escalation. The leak is confined to systems using nfnetlink_queue with bridge packets, which is common in firewall and network filtering setups.

Mitigation

The fix is included in the Linux kernel stable commit [1], which drops the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in the file. Users should apply the patch or update to a kernel version containing this commit. No workaround is documented.