Out-of-Bounds Stack Read in Linux Kernel Affecting Netfilter

CVE-2026-43453

What is CVE-2026-43453?

A vulnerability has been identified in the Linux kernel's netfilter component, specifically within the pipapo_drop() function. This flaw arises from how the function handles the rulemap array, leading to a potential out-of-bounds stack read. During iterations over the rulemap, the function erroneously accesses an element beyond the allocated boundary of the stack-allocated array. Although a safeguard exists that prevents further processing when the last item is reached, the argument passed to pipapo_unmap() is evaluated, inadvertently resulting in a read error. Mitigation involves ensuring that the last iteration correctly bypasses the erroneous read.

References