CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftct: drop pending enqueued packets on removal
Packets sitting in nfqueue might hold a reference to:
- templates that specify the conntrack zone, because a percpu area is used and module removal is possible. - conntrack timeout policies and helper, where object removal leave a stale reference.
Since these objects can just go away, drop enqueued packets to avoid stale reference to them.
If there is a need for finer grain removal, this logic can be revisited to make selective packet drop upon dependencies.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43060?
CVE-2026-43060 is classified as a medium severity vulnerability in the Linux kernel's netfilter nft_ct subsystem.
What impact does CVE-2026-43060 have on affected systems?
CVE-2026-43060 can lead to potential denial of service by dropping packets that are pending in nfqueue when their corresponding conntrack objects are removed.
How do I fix CVE-2026-43060?
To mitigate CVE-2026-43060, users should upgrade their Linux kernel to the latest stable version that has resolved this vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-43060?
CVE-2026-43060 affects certain versions of the Linux kernel using the netfilter nft_ct module.
Is CVE-2026-43060 exploitable remotely?
CVE-2026-43060 is not considered to be directly exploitable remotely, but it can lead to issues that might affect overall system performance.