CVE-2026-43024

Awaiting Analysis Awaiting Analysis - Queue

Immediate NF_QUEUE Verdict Rejection in Linux Kernel

Publication date: 2026-05-01

Last updated on: 2026-05-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never used by the userspace nft tools, so reject immediate NF_QUEUE verdicts. The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NF_QUEUE immediate verdicts to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-01

Last Modified

2026-05-08

Generated

2026-07-06

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-04

NVD

CVE-2026-43024

EUVD

EUVD-2026-26623

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	From 6.7.3 (inc) to 6.8 (exc)
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	From 4.19.307 (inc) to 4.20 (exc)
linux	linux_kernel	From 5.4.269 (inc) to 5.5 (exc)
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.13 (inc) to 6.18.22 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.12 (exc)
linux	linux_kernel	From 5.10.210 (inc) to 5.10.253 (exc)
linux	linux_kernel	From 5.15.149 (inc) to 5.15.203 (exc)
linux	linux_kernel	From 6.1.76 (inc) to 6.1.168 (exc)
linux	linux_kernel	From 6.6.15 (inc) to 6.6.134 (exc)
linux	linux_kernel	From 6.8.1 (inc) to 6.12.81 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's netfilter subsystem, specifically in the nf_tables component. The issue involves the handling of the NF_QUEUE verdict, which is used to pass packets from kernel space to userspace for further processing. Normally, the userspace nftables tools use the nft_queue mechanism to deliver the NF_QUEUE verdict, but they never emit this verdict immediately. However, the arp family does not support queueing, yet it can still reach an immediate NF_QUEUE verdict, which is unintended behavior. This vulnerability allows such immediate NF_QUEUE verdicts to be rejected globally to fix the problem.

Impact Analysis

The vulnerability could potentially allow unexpected or unintended packet handling behavior in the Linux kernel's networking stack. Since immediate NF_QUEUE verdicts are not expected or supported by userspace tools, their presence might lead to inconsistent or incorrect packet processing, which could affect network security or stability. By rejecting these immediate NF_QUEUE verdicts globally, the issue is mitigated.

Mitigation Strategies

The vulnerability is addressed by globally rejecting immediate NF_QUEUE verdicts in the Linux kernel's netfilter nf_tables subsystem.

Since nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict and immediate NF_QUEUE verdicts are never used by userspace nft tools, ensuring your system is updated with the patch that rejects immediate NF_QUEUE verdicts will mitigate this issue.

Hi! I’m here to help you understand CVE-2026-43024. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70