CVE-2026-43026 Linux CVE debrief

Who should care

Users of Linux kernel versions from 3.4 to 7.0 rc6 should be aware of this vulnerability and take steps to mitigate it. This includes applying patches provided by the Linux kernel maintainers, inventorying and updating affected Linux kernel versions, and monitoring for potential exploitation attempts. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and take necessary actions.

Technical summary

The vulnerability exists in the Linux kernel's netfilter: ctnetlink component. When CTA_EXPECT_NAT is not present in the netlink message, the saved_addr and saved_proto fields are not initialized, leading to stale data being dumped to userspace. This issue can be mitigated by applying the provided patches. The fix involves explicitly zeroing the saved_addr, saved_proto, and dir fields in the else branch, guarded by IS_ENABLED(CONFIG_NF_NAT).

Defensive priority

Medium priority due to the availability of patches and the potential impact of the vulnerability

Recommended defensive actions

• Apply patches provided by the Linux kernel maintainers
• Inventory and update affected Linux kernel versions
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by explicitly zeroing the saved_addr, saved_proto, and dir fields in the else branch, guarded by IS_ENABLED(CONFIG_NF_NAT). To verify, defenders should review the Linux kernel source code, specifically the ctnetlink_alloc_expect() function, and confirm that the fix has been applied. Additionally, defenders should check for potential exploitation attempts by monitoring network traffic and system logs.

Official resources