CVE-2026-43451 Overview
CVE-2026-43451 is a memory leak vulnerability in the Linux kernel's netfilter subsystem, specifically within the nfnetlink_queue component. The flaw resides in the nfqnl_recv_verdict() function, which fails to release a dequeued queue entry when nfqa_parse_bridge() returns an error for PF_BRIDGE packets. Each failed verdict leaks an nf_queue_entry, its associated sk_buff, and held references to net_device and struct net objects. Repeated triggering exhausts kernel memory and can lead to denial-of-service conditions on affected systems.
Critical Impact
Local attackers with CAP_NET_ADMIN capability can exhaust kernel memory by repeatedly submitting malformed bridge verdict messages, leading to system instability and denial of service.
Affected Products
- Linux kernel versions implementing nfnetlink_queue with bridge family (PF_BRIDGE) support
- Distributions shipping kernels prior to the stable fix commits referenced in the kernel.org advisories
- Systems using netfilter queue userspace handlers for bridged traffic
Discovery Timeline
- 2026-05-08 - CVE-2026-43451 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43451
Vulnerability Analysis
The vulnerability resides in the netfilter queue subsystem, which forwards packets from the kernel to userspace for inspection and verdict. When userspace returns a verdict, nfqnl_recv_verdict() invokes find_dequeue_entry() to remove the corresponding entry from the queue data structures. After this call, the function takes ownership of the entry and becomes responsible for its lifecycle.
For packets in the PF_BRIDGE protocol family, the verdict handler then calls nfqa_parse_bridge() to parse optional VLAN attributes. If this parser returns an error, for example when the NFQA_VLAN attribute is present but the required NFQA_VLAN_TCI sub-attribute is missing, the function returns immediately without freeing the dequeued entry or its associated sk_buff. The leaked structures retain references to net_device and struct net objects.
Root Cause
The root cause is an incomplete error path in nfqnl_recv_verdict(). Ownership transfer occurs at find_dequeue_entry(), but the subsequent error branch from nfqa_parse_bridge() lacks a cleanup call. This represents a classic Memory Leak [CWE-401] pattern where resource ownership transitions are not matched with corresponding release paths.
Attack Vector
An attacker with the ability to interact with nfnetlink_queue (typically requiring CAP_NET_ADMIN within a user namespace) can craft repeated verdict messages targeting bridge-family queues. Each malformed verdict containing an NFQA_VLAN attribute without NFQA_VLAN_TCI leaks kernel memory. Sustained exploitation drains net_device and struct net reference counts and exhausts kernel allocations, producing denial of service.
The vulnerability is described in prose only; no public proof-of-concept code is referenced in the advisory. See the Linux Kernel Commit cf4a4df3 and related stable tree commits for the precise code paths involved.
Detection Methods for CVE-2026-43451
Indicators of Compromise
- Steady growth in kernel slab allocations for skbuff_head_cache and netfilter queue entry caches without corresponding releases
- Increasing reference counts on bridge net_device objects that fail to drop on interface teardown
- Repeated nfnetlink verdict messages from userspace processes targeting PF_BRIDGE queues with malformed VLAN attributes
Detection Strategies
- Monitor /proc/slabinfo for abnormal growth of nf_queue_entry and skbuff related slabs on hosts running bridged netfilter queues
- Audit processes invoking NFNL_SUBSYS_QUEUE with NFQNL_MSG_VERDICT and inspect for repeated error returns in kernel logs
- Correlate kernel memory pressure events with userspace processes holding netfilter queue file descriptors
Monitoring Recommendations
- Enable kernel memory accounting and alert on sustained, unexplained growth in netfilter-related slab caches
- Track CAP_NET_ADMIN usage and the creation of user namespaces by unprivileged accounts
- Forward kernel and audit logs to a centralized analytics platform for longitudinal review of netlink and netfilter activity
How to Mitigate CVE-2026-43451
Immediate Actions Required
- Apply the upstream kernel patches referenced in the kernel.org stable commits as soon as your distribution publishes updated packages
- Restrict CAP_NET_ADMIN and unprivileged user namespace creation on systems exposed to untrusted local users
- Audit which services and containers require access to nfnetlink_queue and remove the capability where not needed
Patch Information
The fix drops the dequeued entry via nfqnl_reinject() with an NF_DROP verdict on the error path, mirroring other error-handling logic in nfnetlink_queue.c. Stable tree fixes are available across multiple maintained branches via the following commits: Linux Kernel Commit 0b18d1b, Linux Kernel Commit 208669df, Linux Kernel Commit 47b1c5d1, Linux Kernel Commit 9853d94b, Linux Kernel Commit a907bea2, Linux Kernel Commit b38d2b46, Linux Kernel Commit cf4a4df3, and Linux Kernel Commit f1ba8375.
Workarounds
- Disable unprivileged user namespaces where the workload allows by setting kernel.unprivileged_userns_clone=0
- Remove or constrain processes that bind to NFNL_SUBSYS_QUEUE for PF_BRIDGE traffic until the patched kernel is deployed
- Apply seccomp or LSM policies to block socket(AF_NETLINK, ..., NETLINK_NETFILTER) from non-essential workloads
# Configuration example - restrict unprivileged netlink and namespace use
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w user.max_user_namespaces=0
# Verify installed kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
