CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: ignore explicit helper on new expectations
Use the existing master conntrack helper, anything else is not really supported and it just makes validation more complicated, so just ignore what helper userspace suggests for this expectation.
This was uncovered when validating CTAEXPECTCLASS via different helper provided by userspace than the existing master conntrack helper:
BUG: KASAN: slab-out-of-bounds in nfctexpectrelatedreport+0x2479/0x27c0 Read of size 4 at addr ffff8880043fe408 by task poc/102 Call Trace: nfctexpectrelatedreport+0x2479/0x27c0 ctnetlinkcreateexpect+0x22b/0x3b0 ctnetlinknewexpect+0x4bd/0x5c0 nfnetlinkrcvmsg+0x67a/0x950 netlinkrcvskb+0x120/0x350
Allowing to read kernel memory bytes off the expectation boundary.
CTAEXPECTHELPNAME is still used to offer the helper name to userspace via netlink dump.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43025?
CVE-2026-43025 has been classified with a moderate severity level due to its potential impact on the netfilter framework.
How do I fix CVE-2026-43025?
To address CVE-2026-43025, users should update to the latest stable version of the Linux kernel that contains the patch for this vulnerability.
Who is affected by CVE-2026-43025?
CVE-2026-43025 primarily affects systems using the Linux kernel with the netfilter framework implemented.
What type of vulnerability is CVE-2026-43025?
CVE-2026-43025 is a vulnerability related to the improper handling of netfilter ctnetlink expectations in the Linux kernel.
Is there a workaround for CVE-2026-43025?
There are currently no known effective workarounds for CVE-2026-43025, so upgrading the kernel is recommended.