CVE-2026-43084 (GCVE-0-2026-43084)

Vulnerability from cvelistv5 – Published: 2026-05-06 07:40 – Updated: 2026-08-05 12:25
VLAI
Title
netfilter: nfnetlink_queue: make hash table per queue
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930 kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem pressure.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 371de2bef6582a3f58049b3d18e190924af9c9a0 , < 22730cb96093b5be0609063bbb1923dbecd61252 (git)
Affected: 870e3e63da8e88daffe9d692a025c711658018a8 , < 41e3652a178cb0eecd48e0e6e27fbb73a004046a (git)
Affected: 70e2e3ce4f6841e12ec1c104fc76c0e707398ec4 , < 9e5ebef91120d2764aefe557c3a484b6288f341f (git)
Affected: e19079adcd26a25d7d3e586b1837493361fdf8b6 , < 936206e3f6ff411581e615e930263d6f8b78df9d (git)
Create a notification for this product.
Linux Linux Affected: 6.12.75 , < 6.12.83 (semver)
Affected: 6.18.14 , < 6.18.24 (semver)
Affected: 6.19.4 , < 6.19.14 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22730cb96093b5be0609063bbb1923dbecd61252",
              "status": "affected",
              "version": "371de2bef6582a3f58049b3d18e190924af9c9a0",
              "versionType": "git"
            },
            {
              "lessThan": "41e3652a178cb0eecd48e0e6e27fbb73a004046a",
              "status": "affected",
              "version": "870e3e63da8e88daffe9d692a025c711658018a8",
              "versionType": "git"
            },
            {
              "lessThan": "9e5ebef91120d2764aefe557c3a484b6288f341f",
              "status": "affected",
              "version": "70e2e3ce4f6841e12ec1c104fc76c0e707398ec4",
              "versionType": "git"
            },
            {
              "lessThan": "936206e3f6ff411581e615e930263d6f8b78df9d",
              "status": "affected",
              "version": "e19079adcd26a25d7d3e586b1837493361fdf8b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.12.83",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.24",
              "status": "affected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.19.14",
              "status": "affected",
              "version": "6.19.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "6.18.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "6.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: make hash table per queue\n\nSharing a global hash table among all queues is tempting, but\nit can cause crash:\n\nBUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\n[..]\n nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\n nfnetlink_rcv_msg+0x46a/0x930\n kmem_cache_alloc_node_noprof+0x11e/0x450\n\nstruct nf_queue_entry is freed via kfree, but parallel cpu can still\nencounter such an nf_queue_entry when walking the list.\n\nAlternative fix is to free the nf_queue_entry via kfree_rcu() instead,\nbut as we have to alloc/free for each skb this will cause more mem\npressure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local NETLINK_NETFILTER/NFQUEUE verdict handling, not directly by unauthenticated network packets. A local attacker can set up NFQUEUE state and generate queued packets.\nAC:L - The attacker can control the relevant queues, packet flow, and concurrent verdict submissions, so the race can be exercised repeatedly. Any uncertainty about hash bucket timing is scored as low complexity under the required rule.\nPR:L - NFNETLINK receive requires CAP_NET_ADMIN in the target network namespace. Netfilter is reachable from unprivileged users through user and network namespaces, so this is low privileges rather than high.\nUI:N - No victim action is required after the attacker runs local code. The attacker can create the queue setup, send packets, and issue verdicts directly.\nS:U - The vulnerability corrupts kernel memory within the same kernel security authority. It is a standard local kernel privilege escalation/DoS scenario, not a cross-scope escape.\nC:H - This is a use-after-free of struct nf_queue_entry during rhashtable lookup, and reclaimed object contents can be exposed or steered by heap manipulation. Per kernel scoring guidance, UAF memory corruption supports high confidentiality impact.\nI:H - The stale nf_queue_entry can be acted on after lookup, including removal/list operations and later reinjection logic, giving plausible kernel memory corruption primitives. Per kernel scoring guidance, UAFs are high integrity impact.\nA:H - The fix cites a KASAN slab-use-after-free crash in nfqnl_recv_verdict, and the bug can crash the kernel. Kernel oops/panic availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:51.088Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22730cb96093b5be0609063bbb1923dbecd61252"
        },
        {
          "url": "https://git.kernel.org/stable/c/41e3652a178cb0eecd48e0e6e27fbb73a004046a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e5ebef91120d2764aefe557c3a484b6288f341f"
        },
        {
          "url": "https://git.kernel.org/stable/c/936206e3f6ff411581e615e930263d6f8b78df9d"
        }
      ],
      "title": "netfilter: nfnetlink_queue: make hash table per queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43084",
    "datePublished": "2026-05-06T07:40:19.253Z",
    "dateReserved": "2026-05-01T14:12:55.983Z",
    "dateUpdated": "2026-08-05T12:25:51.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43084",
      "date": "2026-08-11",
      "epss": "0.00125",
      "percentile": "0.02589"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43084\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T10:16:21.610\",\"lastModified\":\"2026-06-17T10:48:54.403\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nfnetlink_queue: make hash table per queue\\n\\nSharing a global hash table among all queues is tempting, but\\nit can cause crash:\\n\\nBUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\\n[..]\\n nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\\n nfnetlink_rcv_msg+0x46a/0x930\\n kmem_cache_alloc_node_noprof+0x11e/0x450\\n\\nstruct nf_queue_entry is freed via kfree, but parallel cpu can still\\nencounter such an nf_queue_entry when walking the list.\\n\\nAlternative fix is to free the nf_queue_entry via kfree_rcu() instead,\\nbut as we have to alloc/free for each skb this will cause more mem\\npressure.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/netfilter/nf_queue.h\",\"net/netfilter/nfnetlink_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"371de2bef6582a3f58049b3d18e190924af9c9a0\",\"lessThan\":\"22730cb96093b5be0609063bbb1923dbecd61252\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"870e3e63da8e88daffe9d692a025c711658018a8\",\"lessThan\":\"41e3652a178cb0eecd48e0e6e27fbb73a004046a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"70e2e3ce4f6841e12ec1c104fc76c0e707398ec4\",\"lessThan\":\"9e5ebef91120d2764aefe557c3a484b6288f341f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e19079adcd26a25d7d3e586b1837493361fdf8b6\",\"lessThan\":\"936206e3f6ff411581e615e930263d6f8b78df9d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/netfilter/nf_queue.h\",\"net/netfilter/nfnetlink_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12.75\",\"lessThan\":\"6.12.83\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.18.14\",\"lessThan\":\"6.18.24\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.19.4\",\"lessThan\":\"6.19.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.75\",\"versionEndExcluding\":\"6.12.83\",\"matchCriteriaId\":\"E1A21D87-0999-4B99-8C46-E845E91596BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18.14\",\"versionEndExcluding\":\"6.18.24\",\"matchCriteriaId\":\"F1EF34AA-110D-41A4-A945-0F3F8D525789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19.4\",\"versionEndExcluding\":\"6.19.14\",\"matchCriteriaId\":\"92491DD1-C41C-4797-A5EB-8523985265BA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22730cb96093b5be0609063bbb1923dbecd61252\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41e3652a178cb0eecd48e0e6e27fbb73a004046a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/936206e3f6ff411581e615e930263d6f8b78df9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e5ebef91120d2764aefe557c3a484b6288f341f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T19:17:42+00:00",
      "cve": "CVE-2026-43084",
      "id": "CVE-2026-43084",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nfnetlink_queue: make hash table per queue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43084.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:21:38Z",
      "cve": "CVE-2026-43084",
      "id": "CVE-2026-43084",
      "initial_release_date": "2026-05-07T02:18:56Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43084",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43084.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.