CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlinkqueue: fix entry leak in bridge verdict error path
nfqnlrecvverdict() calls finddequeueentry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PFBRIDGE packets, it then calls nfqaparsebridge() to parse VLAN attributes. If nfqaparsebridge() returns an error (e.g. NFQAVLAN present but NFQAVLANTCI missing), the function returns immediately without freeing the dequeued entry or its skbuff.
This leaks the nfqueueentry, its associated skbuff, and all held references (netdevice refcounts, struct net refcount). Repeated triggering exhausts kernel memory.
Fix this by dropping the entry via nfqnlreinject() with NFDROP verdict on the error path, consistent with other error handling in this file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43451?
CVE-2026-43451 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2026-43451?
To fix CVE-2026-43451, upgrade your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What impact does CVE-2026-43451 have on affected systems?
CVE-2026-43451 can lead to resource leaks which may reduce system performance or stability under certain conditions.
Which versions of the Linux kernel are affected by CVE-2026-43451?
CVE-2026-43451 affects specific versions of the Linux kernel prior to the fix being implemented in the latest updates.
Is CVE-2026-43451 exploitable remotely?
CVE-2026-43451 is not considered remotely exploitable as it requires local access to the system to exploit.