Vulnerability in Linux Kernel Affecting Netfilter and NF_QUEUE Verdicts

CVE-2026-43024

What is CVE-2026-43024?

A vulnerability has been identified in the Linux kernel related to the netfilter subsystem, specifically concerning the NF_QUEUE verdict. Within the nftables framework, immediate NF_QUEUE verdicts are not utilized by userspace tools. However, an unexpected scenario allows for the triggering of such verdicts through the arp family, which traditionally does not support queuing. This oversight enables the potential for unauthorized manipulations, necessitating a global rejection of immediate NF_QUEUE verdicts to reinforce system integrity and protect against exploitation.

References