Memory Management Flaw in Linux Kernel's Netfilter Component by Linux Foundation

CVE-2026-43084

What is CVE-2026-43084?

A vulnerability in the Linux kernel's netfilter component has been disclosed, where the use of a global hash table for all queues can lead to memory corruption issues. Specifically, this issue arises when the nf_queue_entry structure is freed via kfree, but other CPU threads may still access the freed entry while iterating through the list. This flaw can lead to crashes and is linked to the nfqnl_recv_verdict function. An alternative method, using kfree_rcu, has been suggested, but it introduces additional memory pressure due to the need for per-socket buffer allocation and deallocation.

References