CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: strictly check for maximum number of actions
The maximum number of flowtable hardware offload actions in IPv6 is:
ethernet mangling (4 payload actions, 2 for each ethernet address) SNAT (4 payload actions) DNAT (4 payload actions) Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) for QinQ. Redirect (1 action)
Which makes 17, while the maximum is 16. But actct supports for tunnels actions too. Note that payload action operates at 32-bit word level, so mangling an IPv6 address takes 4 payload actions.
Update flowactionentrynext() calls to check for the maximum number of supported actions.
While at it, rise the maximum number of actions per flow from 16 to 24 so this works fine with IPv6 setups.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43329?
CVE-2026-43329 has a medium severity rating due to potential impacts on system performance and integrity.
How do I fix CVE-2026-43329?
To fix CVE-2026-43329, update your Linux kernel to the latest stable version that resolves this vulnerability.
What types of systems are vulnerable to CVE-2026-43329?
CVE-2026-43329 affects systems running vulnerable versions of the Linux kernel that utilize netfilter flowtables.
What are the potential impacts of CVE-2026-43329?
The impacts of CVE-2026-43329 include improper handling of maximum flowtable actions, which could lead to denial of service or other unexpected behavior.
How can I check if my system is affected by CVE-2026-43329?
You can check if your system is affected by CVE-2026-43329 by reviewing the kernel version and comparing it to known vulnerable versions.