CVE-2026-43024
Awaiting Analysis Awaiting Analysis - Queue
Immediate NF_QUEUE Verdict Rejection in Linux Kernel

Publication date: 2026-05-01

Last updated on: 2026-05-08

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never used by the userspace nft tools, so reject immediate NF_QUEUE verdicts. The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NF_QUEUE immediate verdicts to address this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-08
Generated
2026-06-16
AI Q&A
2026-05-01
EPSS Evaluated
2026-06-14
NVD
CVE-2026-43024
EUVD
EUVD-2026-26623
Affected Vendors & Products
Showing 23 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.8
linux linux_kernel 6.8
linux linux_kernel 6.8
linux linux_kernel 6.8
linux linux_kernel From 6.7.3 (inc) to 6.8 (exc)
linux linux_kernel 6.8
linux linux_kernel 6.8
linux linux_kernel 6.8
linux linux_kernel From 4.19.307 (inc) to 4.20 (exc)
linux linux_kernel From 5.4.269 (inc) to 5.5 (exc)
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.22 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.12 (exc)
linux linux_kernel From 5.10.210 (inc) to 5.10.253 (exc)
linux linux_kernel From 5.15.149 (inc) to 5.15.203 (exc)
linux linux_kernel From 6.1.76 (inc) to 6.1.168 (exc)
linux linux_kernel From 6.6.15 (inc) to 6.6.134 (exc)
linux linux_kernel From 6.8.1 (inc) to 6.12.81 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's netfilter subsystem, specifically in the nf_tables component. The issue involves the handling of the NF_QUEUE verdict, which is used to pass packets from kernel space to userspace for further processing. Normally, the userspace nftables tools use the nft_queue mechanism to deliver the NF_QUEUE verdict, but they never emit this verdict immediately. However, the arp family does not support queueing, yet it can still reach an immediate NF_QUEUE verdict, which is unintended behavior. This vulnerability allows such immediate NF_QUEUE verdicts to be rejected globally to fix the problem.

Impact Analysis

The vulnerability could potentially allow unexpected or unintended packet handling behavior in the Linux kernel's networking stack. Since immediate NF_QUEUE verdicts are not expected or supported by userspace tools, their presence might lead to inconsistent or incorrect packet processing, which could affect network security or stability. By rejecting these immediate NF_QUEUE verdicts globally, the issue is mitigated.

Mitigation Strategies

The vulnerability is addressed by globally rejecting immediate NF_QUEUE verdicts in the Linux kernel's netfilter nf_tables subsystem.

Since nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict and immediate NF_QUEUE verdicts are never used by userspace nft tools, ensuring your system is updated with the patch that rejects immediate NF_QUEUE verdicts will mitigate this issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart