CVE-2026-43116: Linux Kernel Race Condition Vulnerability

CVE-2026-43116 Overview

CVE-2026-43116 is a Linux kernel vulnerability in the netfilter ctnetlink subsystem. The flaw allows unsafe access to the master conntrack object through an expectation reference. Holding a reference on the expectation does not prevent the master conntrack object from being freed, which leaves exp->master pointing to invalid memory. The issue affects expectation lookup paths in the connection tracking netlink interface used for stateful firewall management.

Critical Impact
A race between expectation handling and master conntrack teardown can leave exp->master referencing freed memory, leading to potential use-after-free conditions in kernel space when delete or get expectation commands are processed.

Affected Products

Linux kernel netfilter subsystem (ctnetlink)
Distributions shipping vulnerable kernel versions prior to the fix commits
Systems using nf_conntrack_expect for stateful firewall expectations

Discovery Timeline

2026-05-06 - CVE-2026-43116 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43116

Vulnerability Analysis

The vulnerability resides in the ctnetlink code path that handles connection tracking expectations. Each expectation object carries a pointer to its master conntrack via exp->master. The code assumed that holding a reference on the expectation was sufficient to keep the master conntrack alive. That assumption is incorrect. The master conntrack can be removed independently, after which exp->master becomes a dangling pointer.

The fix extends the nf_conntrack_expect_lock spinlock section so that expectation lookup and master access are serialized with clean_from_lists(), which holds the same lock when the master conntrack goes away. The patch also moves the IPEXP_NEW event delivery under the spinlock because the master conntrack event cache is reached through exp->master.

Root Cause

The root cause is a reference counting and locking gap [Use After Free]. The expectation reference does not pin the master conntrack lifetime. Without nf_conntrack_expect_lock held during expectation lookup and master access, a concurrent path executing clean_from_lists() can release the master conntrack while ctnetlink still dereferences exp->master.

Attack Vector

The vulnerable code is reachable through the netlink interface for connection tracking expectations. Specifically, the delete expectation command performed expectation lookup outside the spinlock, and the get expectation command did the same. A local actor able to issue netlink requests against the conntrack expectation table can race expectation queries with master conntrack teardown to trigger access to freed memory.

The upstream fix is described in the kernel commit log for the netfilter ctnetlink master conntrack access fix. See the kernel commit 497f99b26fff, kernel commit bffcaad9afdf, and kernel commit f338ced04738 for the patch details.

Detection Methods for CVE-2026-43116

Indicators of Compromise

Kernel oops or panic logs referencing nf_conntrack or ctnetlink_* symbols in the call trace.
KASAN reports flagging use-after-free in nf_ct_expect_* or accesses through exp->master.
Unexpected process terminations or kernel warnings during heavy conntrack expectation churn.

Detection Strategies

Monitor dmesg and /var/log/kern.log for stack traces involving ctnetlink_exp_* and nf_conntrack_expect_lock.
Compare running kernel version and build against distribution advisories that reference the three upstream fix commits.
Audit netlink usage for processes interacting with NFNL_SUBSYS_CTNETLINK_EXP to identify privileged actors performing expectation operations.

Monitoring Recommendations

Enable kernel crash collection (kdump) so use-after-free crashes can be analyzed post-incident.
Track package versions across the fleet to confirm patched kernels are deployed on hosts using stateful firewalls or NAT helpers (FTP, SIP, PPTP).
Alert on repeated netfilter warnings emitted by WARN_ON_ONCE and lockdep annotations introduced by the fix.

How to Mitigate CVE-2026-43116

Immediate Actions Required

Apply the upstream Linux kernel patch series that extends the nf_conntrack_expect_lock section across expectation lookup paths.
Update to a distribution kernel that includes the three referenced commits and reboot affected systems.
Restrict access to CAP_NET_ADMIN so only trusted processes can issue conntrack expectation netlink commands.

Patch Information

The fix is delivered through three upstream commits in the stable kernel tree: 497f99b26fff, bffcaad9afdf, and f338ced04738. The patches expand the spinlock section, hold the lock during expectation lookup in delete and get paths, move IPEXP_NEW delivery under the spinlock, and add lockdep notations.

Workarounds

Where patching is delayed, limit which users and namespaces can open NETLINK_NETFILTER sockets and call into expectation operations.
Disable conntrack helpers that rely on expectations (for example, FTP, SIP, PPTP) if they are not required by the workload.
Apply seccomp or LSM policies to block socket(AF_NETLINK, ..., NETLINK_NETFILTER) for untrusted services.

bash

# Verify the running kernel version and confirm the fix is present
uname -r

# Check whether conntrack helpers using expectations are enabled
sysctl net.netfilter.nf_conntrack_helper

# Disable automatic helper assignment if not required
sysctl -w net.netfilter.nf_conntrack_helper=0