CVE-2026-43450
Out-of-Bounds Read in Linux Kernel Netfilter nfnetlink_cthelper
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's netfilter component, specifically in the nfnetlink_cthelper module within the function nfnl_cthelper_dump_table().
The issue arises because a 'goto restart' statement jumps to a label inside the for loop body incorrectly. When the 'last' helper stored in cb->args[1] is deleted between dump rounds, the condition (cur != last) fails for every entry, so cb->args[1] is never cleared.
As a result, the for loop completes with cb->args[0] equal to nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check. This causes an 8-byte out-of-bounds read on nf_ct_helper_hash at index nf_ct_helper_hsize.
The intended behavior was for the 'goto restart' to re-traverse the current bucket only while cb->args[0] is within bounds, but it was placed incorrectly after the for loop instead of inside it.
How can this vulnerability impact me? :
This vulnerability can lead to an out-of-bounds read in kernel memory, which may cause system instability or crashes.
An attacker with the ability to trigger this code path could potentially exploit this flaw to read sensitive kernel memory, leading to information disclosure.
While the description does not explicitly mention privilege escalation or remote code execution, out-of-bounds reads in kernel space are serious as they can be leveraged in further attacks.