Riskcovery

CVE-2026-43060

netfilter: nft_ct: drop pending enqueued packets on removal

State
Published
Severity
7.8 High
Published
May 5, 2026
Updated
Oct 19, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: drop pending enqueued packets on removal

Packets sitting in nfqueue might hold a reference to:

- templates that specify the conntrack zone, because a percpu area is used and module removal is possible. - conntrack timeout policies and helper, where object removal leave a stale reference.

Since these objects can just go away, drop enqueued packets to avoid stale reference to them.

If there is a need for finer grain removal, this logic can be revisited to make selective packet drop upon dependencies.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before 8a64e76933672b08bd85b63086f33432070fd729Affected
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before 3da0b946835f33bf36b459ead764c61a761e689bAffected
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before ab50302190b303f847c4eba0e31a01a56dec596eAffected
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before e68a8db3a0546482b34e9ca5ca886bcf73eb37bbAffected
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before 6802ff8beceb9c4254318e81c1395720438f2cc2Affected
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before f29a055e4f593e577805b41228b142b58f48df1bAffected
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before 77da55dee67720e2b8d2db49a53334e6c017ee7bAffected
  • 7e0b2b57f01d183e1c84114f1f2287737358d748 to before 36eae0956f659e48d5366d9b083d9417f3263ddcAffected
LinuxLinux
  • 4.19Affected
  • before 4.19Not affected
  • 5.10.253 through 5.10.*Not affected
  • 5.15.203 through 5.15.*Not affected
  • 6.1.167 through 6.1.*Not affected
  • 6.6.130 through 6.6.*Not affected
  • 6.12.78 through 6.12.*Not affected
  • 6.18.20 through 6.18.*Not affected
  • 6.19.10 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.