CVE-2026-43024
Awaiting Analysis Awaiting Analysis - Queue
Immediate NF_QUEUE Verdict Rejection in Linux Kernel

Publication date: 2026-05-01

Last updated on: 2026-05-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never used by the userspace nft tools, so reject immediate NF_QUEUE verdicts. The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NF_QUEUE immediate verdicts to address this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-01
Generated
2026-05-06
AI Q&A
2026-05-01
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's netfilter subsystem, specifically in the nf_tables component. The issue involves the handling of the NF_QUEUE verdict, which is used to pass packets from kernel space to userspace for further processing. Normally, the userspace nftables tools use the nft_queue mechanism to deliver the NF_QUEUE verdict, but they never emit this verdict immediately. However, the arp family does not support queueing, yet it can still reach an immediate NF_QUEUE verdict, which is unintended behavior. This vulnerability allows such immediate NF_QUEUE verdicts to be rejected globally to fix the problem.


How can this vulnerability impact me? :

The vulnerability could potentially allow unexpected or unintended packet handling behavior in the Linux kernel's networking stack. Since immediate NF_QUEUE verdicts are not expected or supported by userspace tools, their presence might lead to inconsistent or incorrect packet processing, which could affect network security or stability. By rejecting these immediate NF_QUEUE verdicts globally, the issue is mitigated.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is addressed by globally rejecting immediate NF_QUEUE verdicts in the Linux kernel's netfilter nf_tables subsystem.

Since nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict and immediate NF_QUEUE verdicts are never used by userspace nft tools, ensuring your system is updated with the patch that rejects immediate NF_QUEUE verdicts will mitigate this issue.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart