--- cve: "CVE-2026-43026" severity: "LOW" cvss: 3.1 epss: "13%" vendor: "Linux" kev: false exploited: false published: "2026-05-01 15:16:47" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-12T03:24:22+02:00" --- # CVE-2026-43026 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ctnetlink_alloc_expect() allocates expectations from a non-zeroing slab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not present in the netlink message, saved_addr and saved_proto are never initialized. Stale data from a previous slab occupant can then be dumped to userspace by ctnetlink_exp_dump_expect(), which checks these fields to decide whether to emit CTA_EXPECT_NAT. The safe sibling nf_ct_expect_init(), used by the packet path, explicitly zeroes these fields. Zero saved_addr, saved_proto and dir in the else branch, guarded by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when NAT is enabled. Confirmed by priming the expect slab with NAT-bearing expectations, freeing them, creating a new expectation without CTA_EXPECT_NAT, and observing that the ctnetlink dump emits a spurious CTA_EXPECT_NAT containing stale data from the prior allocation. ## Patch verfügbar (OSV) - Kernel ≥ 5.10.253 - Kernel ≥ 5.15.203 - Kernel ≥ 6.1.168 - Kernel ≥ 6.6.134 - Kernel ≥ 6.12.81 - Kernel ≥ 6.18.22 - Kernel ≥ 6.19.12 ## Referenzen - - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-43026) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_