CVE-2026-43025 netfilter: ctnetlink: ignore explicit helper on new expectations
A local attacker can trigger a slab-out-of-bounds read in the Linux kernel netfilter subsystem, potentially leaking kernel memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43025?
CVE-2026-43025 is a high-severity memory corruption vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: ignore explicit helper on new expectations
Use the existing master conntrack helper, anything else is not really supported and it just makes validation more complicated, so just ignore what helper userspace suggests for this expectation.
This was uncovered when validating CTA_EXPECT_CLASS via different helper provided by userspace than the existing master conntrack helper:
BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0 Read of size 4 at addr ffff8880043fe408 by task poc/102 Call Trace: nf_ct_expect_related_report+0x2479/0x27c0 ctnetlink_create_expect+0x22b/0x3b0 ctnetlink_new_expect+0x4bd/0x5c0 nfnetlink_rcv_msg+0x67a/0x950 netlink_rcv_skb+0x120/0x350
Allowing to read kernel memory bytes off the expectation boundary.
CTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace via netlink dump.
Weakness: CWE-125
Which versions are affected by CVE-2026-43025?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43025?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43025 being exploited?
There is no known exploitation of CVE-2026-43025 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43025, DEBIAN-CVE-2026-43025, GHSA-9qfg-56vg-wf9g, ROOT-OS-DEBIAN-11-CVE-2026-43025, ROOT-OS-UBUNTU-2204-CVE-2026-43025, ROOT-OS-UBUNTU-2404-CVE-2026-43025 and 1 more.