CVE-2026-43329 Git CVE debrief

Who should care

Linux operators and vendors using kernels with netfilter flowtable hardware offload, especially in environments that rely on IPv6, VLAN/QinQ, NAT, redirects, or tunnel-aware offload. Security teams should prioritize systems where untrusted local users can influence networking configuration or packet paths.

Technical summary

The record states that the maximum number of flowtable hardware offload actions in IPv6 can reach 17, exceeding the prior limit of 16. Because payload actions operate at 32-bit word granularity, IPv6 address mangling consumes multiple actions, and act_ct can add tunnel-related actions as well. The fix updates flow_action_entry_next() call sites to enforce the maximum supported action count and increases the allowed per-flow action budget to 24 to accommodate legitimate IPv6 offload cases.

Defensive priority

High. The CVSS vector is local, low-privilege, and rates high for confidentiality, integrity, and availability impact. Kernel networking flaws can have broad blast radius, so affected systems should be patched promptly.

Recommended defensive actions

• Install the kernel updates that include the flowtable action-count fix.
• Check whether your systems use netfilter flowtable hardware offload, especially with IPv6, VLAN/QinQ, NAT, redirects, or tunnels.
• Prioritize patching hosts where local users or containers can interact with networking features.
• Track downstream vendor advisories and backports for the relevant kernel branch.
• After updating, verify that offload-dependent IPv6 configurations still function as expected.
• If immediate patching is not possible, reduce exposure to flowtable offload paths where operationally feasible.

Evidence notes

Based only on the supplied NVD CVE record and the linked kernel.org stable references. The record explicitly describes the action-count mismatch, the IPv6-specific maximum of 17 actions, the prior limit of 16, and the remediation to enforce bounds and raise the limit to 24. No exploit details beyond the official record are used.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.