Netfilter x_tables Name Null-Termination Flaw

Publication date: 2026-05-01

Last updated on: 2026-05-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names that lack a \0 character before feeding them to functions that expect c-strings. Fixes tag is the most recent commit that needs this change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-01

Last Modified

2026-05-08

Generated

2026-07-06

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43028

EUVD

EUVD-2026-26627

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 5.11 (inc) to 5.15.203 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.22 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.168 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.12 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.81 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.134 (exc)
linux	linux_kernel	From 4.5 (inc) to 5.10.253 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's netfilter x_tables component involves improper handling of string names. Specifically, names that lack a null-terminating character (\0) were not properly rejected before being passed to functions expecting C-style strings. This could lead to unexpected behavior or errors.

Impact Analysis

If exploited, this vulnerability could cause functions that expect null-terminated strings to process malformed input, potentially leading to crashes, memory corruption, or other unpredictable behavior in the Linux kernel's netfilter subsystem.

Hi! I’m here to help you understand CVE-2026-43028. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70