CVE-2026-43027 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, users of Linux-based systems, security teams and researchers, and organizations using Linux-based systems for critical infrastructure or services.

Technical summary

The vulnerability is caused by the nf_conntrack_helper_unregister function passing a NULL pointer to nf_ct_expect_iterate_destroy, which fails to clean up expectations referencing the helper. This leads to a use-after-free condition when the helper object is freed and later accessed. The vulnerability can be triggered by unloading a netfilter helper module. The fix involves passing the actual helper pointer to nf_ct_expect_iterate_destroy, ensuring that expectations referencing the helper are properly destroyed before the helper object is freed.

Defensive priority

High

Recommended defensive actions

• Apply the official patch or update to a fixed kernel version
• Monitor Linux kernel updates and apply patches promptly
• Consider using a Linux distribution that provides timely kernel updates
• Use kernel modules that provide additional security features, such as SELinux or AppArmor
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced in the Linux kernel and has been resolved with a patch. The patch fixes the use-after-free vulnerability by passing the actual helper pointer to nf_ct_expect_iterate_destroy. Multiple kernel versions are affected, including 4.14, 5.11, 5.16, 6.1, 6.2, 6.6, 6.7, 6.12, 6.13, 6.18, and 6.19. However, specific details about the affected versions and configurations are limited, and defenders should verify the vulnerability's presence in their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.