CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: reject immediate NFQUEUE verdict
nftqueue is always used from userspace nftables to deliver the NFQUEUE verdict. Immediately emitting an NFQUEUE verdict is never used by the userspace nft tools, so reject immediate NFQUEUE verdicts.
The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NFQUEUE immediate verdicts to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Globally reject immediate NF_QUEUE verdicts (netfilter: nf_tables: reject immediate NF_QUEUE verdict) to prevent emitting NF_QUEUE verdicts immediately, since verdict is still reachable otherwise.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43024?
CVE-2026-43024 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43024?
To fix CVE-2026-43024, update your Linux kernel to the latest patched version provided by your distribution.
What systems are vulnerable to CVE-2026-43024?
CVE-2026-43024 affects systems running the affected versions of the Linux kernel that utilize netfilter nf_tables.
What is the impact of CVE-2026-43024?
The impact of CVE-2026-43024 could lead to potential denial of service or undesirable behavior due to the NF_QUEUE verdict handling.
When was CVE-2026-43024 discovered?
CVE-2026-43024 was identified and disclosed in 2026, with patches made available shortly after.