Linux Kernel Vulnerability Affecting Netfilter

CVE-2026-43025

What is CVE-2026-43025?

A vulnerability in the Linux kernel's netfilter component allows an attacker to exploit the existing master conntrack helper, leading to potential reading of kernel memory beyond expected boundaries. This issue arose from the handling of expectations in user space, where unsupported helpers were partially processed, complicating validation. When the CTA_EXPECT_CLASS was validated with an incorrect helper, it caused a slab-out-of-bounds error, risking the integrity and confidentiality of kernel space memory. Addressing this vulnerability ensures that only the approved conntrack helpers are utilized, solidifying the kernel's security posture.

References