CVE-2026-43451
Received Received - Intake
Memory Leak in Linux Kernel Netfilter

Publication date: 2026-05-08

Last updated on: 2026-05-08

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff. This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory. Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-08
Generated
2026-05-09
AI Q&A
2026-05-08
EPSS Evaluated
N/A
NVD
CVE-2026-43451
EUVD
EUVD-2026-28757
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's netfilter component, specifically in the nfnetlink_queue subsystem. When processing certain network packets related to bridging (PF_BRIDGE packets), an error in parsing VLAN attributes causes the function to return early without properly freeing allocated resources. This results in a memory leak of queue entries and associated network buffers, which also hold references to network devices and structures.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability has been fixed in the Linux kernel by correcting the error handling in the netfilter nfnetlink_queue code. To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Specifically, ensure your system is running a kernel version released after 2026-05-08 that contains the patch for the nfnetlink_queue entry leak in the bridge verdict error path.


How can this vulnerability impact me? :

The vulnerability causes a memory leak in the kernel by not freeing certain network queue entries and their associated resources when an error occurs. Repeatedly triggering this condition can exhaust kernel memory, potentially leading to degraded system performance, instability, or crashes.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart