CVE-2026-43028 Overview
CVE-2026-43028 is a Linux kernel vulnerability in the netfilter x_tables subsystem. The kernel passed user-supplied table, target, and match names to C-string functions without verifying that the buffers contained a terminating \0 byte. An attacker with local privileges to invoke x_tables operations can trigger out-of-bounds reads when the kernel processes these names. The upstream fix rejects names that lack a nul terminator before they reach functions expecting C-strings.
Critical Impact
Local users with CAP_NET_ADMIN in a user namespace can read kernel memory or crash the host through netfilter x_tables operations, leading to information disclosure and denial of service.
Affected Products
- Linux kernel (multiple stable branches receiving the backport)
- Distributions shipping the unpatched netfilter x_tables module
- Container hosts permitting unprivileged user namespaces with CAP_NET_ADMIN
Discovery Timeline
- 2026-05-01 - CVE-2026-43028 published to NVD
- 2026-05-03 - Last updated in NVD database
Technical Details for CVE-2026-43028
Vulnerability Analysis
The netfilter x_tables subsystem accepts table, match, and target names from userspace through the setsockopt and getsockopt interfaces on IPPROTO_IP, IPPROTO_IPV6, and IPPROTO_ARP. Name fields are fixed-size character arrays inside structures such as xt_entry_match, xt_entry_target, and ipt_get_entries. The kernel then passed these buffers to standard C-string helpers including strcmp, strlen, and request_module.
Without a guaranteed terminating \0, those helpers read past the end of the supplied buffer. The read continues until an unrelated nul byte is encountered in adjacent kernel memory. This produces information disclosure when the result is reflected back to userspace and produces denial of service when the read crosses an unmapped page boundary. The fix validates that each name field contains a nul byte within its declared length and rejects the request with -EINVAL otherwise.
Root Cause
The root cause is missing input validation [CWE-20] on fixed-size name fields supplied by userspace. The x_tables registration and lookup paths trusted that the caller supplied properly terminated strings. Combined with C-string APIs that have no length awareness, the missing check produced an out-of-bounds read condition.
Attack Vector
Exploitation requires local access and the CAP_NET_ADMIN capability. On systems that allow unprivileged user namespaces, an unprivileged process can obtain that capability inside its own namespace and reach the vulnerable code. The attacker crafts an x_tables request whose name fields are completely filled with non-nul bytes, then submits it through the netfilter socket option interface to trigger the out-of-bounds read.
No verified public exploit code is available. See the upstream commits for technical details: Linux Kernel Commit 673bbd3 and Linux Kernel Commit f419bdc.
Detection Methods for CVE-2026-43028
Indicators of Compromise
- Unexpected iptables, ip6tables, or arptables invocations from non-administrative user sessions or container workloads.
- Kernel oops or BUG messages referencing xt_find_table, xt_request_find_match, or xt_request_find_target in dmesg.
- Processes calling setsockopt with IPT_SO_SET_REPLACE or IP6T_SO_SET_REPLACE from contexts that do not normally manage firewall rules.
Detection Strategies
- Audit setsockopt and getsockopt syscalls against SOL_IP, SOL_IPV6, and SOL_ARP using auditd or eBPF probes.
- Alert on unprivileged user namespace creation followed by netfilter configuration calls within the same process tree.
- Correlate kernel ring buffer warnings with the originating UID and container ID to identify suspicious local activity.
Monitoring Recommendations
- Baseline which service accounts and management agents legitimately modify x_tables rules and flag deviations.
- Forward kernel logs and auditd events to a centralized analytics platform for retention and correlation.
- Track the deployed kernel version across the fleet and surface hosts still running unpatched stable branches.
How to Mitigate CVE-2026-43028
Immediate Actions Required
- Apply the stable kernel update containing the upstream fix as soon as your distribution publishes it.
- Inventory hosts that expose unprivileged user namespaces and prioritize patching those first.
- Restrict CAP_NET_ADMIN in container workloads that do not require firewall management.
Patch Information
The fix is distributed across multiple stable branches. Reference commits include Linux Kernel Commit 7312460, Linux Kernel Commit a958a4f, Linux Kernel Commit aa6cd4a, Linux Kernel Commit bcac50e, Linux Kernel Commit c2d4a3a, and Linux Kernel Commit ea01c1b. Confirm the fix is present in the running kernel before closing the ticket.
Workarounds
- Set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 to block unprivileged user namespace creation where feasible.
- Drop CAP_NET_ADMIN from container security profiles using --cap-drop=NET_ADMIN or equivalent Kubernetes securityContext settings.
- Apply seccomp profiles that deny setsockopt on SOL_IP, SOL_IPV6, and SOL_ARP for workloads that never configure firewall rules.
# Configuration example
# Disable unprivileged user namespaces (sysctl)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2026-43028.conf
sudo sysctl --system
# Verify the running kernel and confirm the patch is applied
uname -r
sudo dmesg | grep -i netfilter
# Drop CAP_NET_ADMIN for a container workload
docker run --cap-drop=NET_ADMIN --rm -it ubuntu:24.04 /bin/bash
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
