CVE-2026-43026 Overview
CVE-2026-43026 is an uninitialized memory disclosure vulnerability in the Linux kernel netfilter subsystem, specifically in the ctnetlink connection tracking netlink interface. The flaw resides in ctnetlink_alloc_expect(), which allocates connection tracking expectations from a non-zeroing slab cache through nf_ct_expect_alloc(). When the CTA_EXPECT_NAT attribute is absent from a netlink message, the saved_addr and saved_proto fields remain uninitialized. Stale data from a previous slab occupant can subsequently be leaked to userspace through ctnetlink_exp_dump_expect().
Critical Impact
Local users with CAP_NET_ADMIN can read residual kernel slab memory containing prior NAT expectation data through ctnetlink dumps, potentially exposing networking-related kernel state.
Affected Products
- Linux kernel netfilter subsystem with CONFIG_NF_NAT enabled
- Linux distributions shipping affected mainline and stable kernels prior to the fix commits
- Systems using ctnetlink for connection tracking management (e.g., conntrack-tools, libnetfilter_conntrack consumers)
Discovery Timeline
- 2026-05-01 - CVE CVE-2026-43026 published to NVD
- 2026-05-01 - Last updated in NVD database
Technical Details for CVE-2026-43026
Vulnerability Analysis
The vulnerability is a classic uninitialized memory use issue in kernel slab-allocated structures. The nf_ct_expect_alloc() helper draws expectation objects from a slab cache that does not zero memory on allocation. The packet path uses a sibling initializer, nf_ct_expect_init(), which explicitly clears NAT-related fields. The netlink path through ctnetlink_alloc_expect() lacks this initialization when CTA_EXPECT_NAT is omitted from the user request.
Later, ctnetlink_exp_dump_expect() inspects saved_addr and saved_proto to decide whether to emit a CTA_EXPECT_NAT attribute in the dump. Because those fields contain residual bytes from the previous slab occupant, the kernel emits a spurious CTA_EXPECT_NAT element populated with stale data. The vulnerability was confirmed by priming the expect slab with NAT-bearing expectations, freeing them, and creating a non-NAT expectation that subsequently dumps prior allocation contents.
Root Cause
The root cause is missing zero-initialization of the saved_addr, saved_proto, and dir members in the netlink-driven expectation creation path. The fix introduces explicit zeroing in the else branch covering the no-CTA_EXPECT_NAT case, guarded by IS_ENABLED(CONFIG_NF_NAT) because these fields exist only when NAT support is compiled in.
Attack Vector
A local user holding CAP_NET_ADMIN (or operating in a user namespace with that capability over a network namespace) can craft netlink messages that allocate expectations without CTA_EXPECT_NAT, then issue dump requests to receive responses containing stale slab contents. Repeated allocation and dump cycles can be used to harvest kernel memory adjacent to expectation objects.
No verified public exploitation code is available. Refer to the upstream fix commits referenced in the NVD entry for the precise patched lines and conditions.
Detection Methods for CVE-2026-43026
Indicators of Compromise
- Unexpected CTA_EXPECT_NAT attributes appearing in ctnetlink expectation dumps for connections that were never configured with NAT helpers.
- Userspace tools such as conntrack -E expect reporting NAT tuples on expectations created without NAT parameters.
- Unusual volumes of NFNL_SUBSYS_CTNETLINK_EXP netlink traffic from non-administrative processes.
Detection Strategies
- Audit kernel versions across the fleet against the upstream stable commits (1c2ebde, 2898080, 35177c6, 929f7a9, a5a89db, a64b7bf, bff0f4f, fd002ff) to identify unpatched hosts.
- Monitor auditd for netlink socket creation tied to NETLINK_NETFILTER from unexpected processes or containers.
- Review eBPF or kprobe instrumentation around ctnetlink_alloc_expect and ctnetlink_exp_dump_expect for anomalous call patterns.
Monitoring Recommendations
- Track processes with CAP_NET_ADMIN that interact with nfnetlink sockets, especially in container or multi-tenant environments.
- Alert on workloads that issue rapid sequences of expectation creation followed by IPCTNL_MSG_EXP_GET dump requests.
- Forward kernel and audit logs to a centralized analytics pipeline to correlate suspicious netlink activity with privilege boundaries.
How to Mitigate CVE-2026-43026
Immediate Actions Required
- Apply the upstream Linux kernel patches that zero saved_addr, saved_proto, and dir in the no-CTA_EXPECT_NAT branch of ctnetlink_alloc_expect().
- Update to the latest stable kernel from your distribution vendor that incorporates the fix commits listed in the NVD references.
- Audit container hosts and multi-tenant systems for processes holding CAP_NET_ADMIN and restrict capabilities where unnecessary.
Patch Information
The fix is delivered through multiple stable-tree commits referenced in the NVD entry. Relevant upstream commits include Kernel Git Commit 1c2ebde, Kernel Git Commit 2898080, Kernel Git Commit 35177c6, Kernel Git Commit 929f7a9, Kernel Git Commit a5a89db, Kernel Git Commit a64b7bf, Kernel Git Commit bff0f4f, and Kernel Git Commit fd002ff. Distribution-specific kernel updates should follow these upstream changes.
Workarounds
- Restrict CAP_NET_ADMIN to trusted administrators and avoid granting it inside unprivileged user namespaces.
- Disable user namespace creation for unprivileged users where the operational model permits, using sysctl kernel.unprivileged_userns_clone=0 on supported distributions.
- Where NAT functionality is unnecessary, build or run kernels without CONFIG_NF_NAT to eliminate the vulnerable code path.
- Apply seccomp or LSM policies (AppArmor, SELinux) to block nfnetlink socket access from workloads that do not require connection tracking management.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
