{"id":"CVE-2026-43451","title":"netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: fix entry leak in bridge verdict error path\n\nnfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue\nentry from the queue data s…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < a907bea273b60d3e604ec4e8e1f6c49954805794","Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 0b18d1b834ab5a5009be70b530f978d7989e445b","Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < b38d2b4603fd3dda24eb8b3dd81c18a0930be97b","Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 47b1c5d1b0944aa88299f55a846fabaefc756982","Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < cf4a4df38d1747e06fc54f9879bd7a6f4178032f","Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 9853d94b82d303fc4ac37d592a23a154096ecd41","Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 208669df703a25a601f45822b10c413f258bf275","Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < f1ba83755d81c6fc66ac7acd723d238f974091e9","Linux 4.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:39:18.435118Z"},"published":"2026-05-08","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:55.539Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43451","references":[{"url":"https://git.kernel.org/stable/c/a907bea273b60d3e604ec4e8e1f6c49954805794"},{"url":"https://git.kernel.org/stable/c/0b18d1b834ab5a5009be70b530f978d7989e445b"},{"url":"https://git.kernel.org/stable/c/b38d2b4603fd3dda24eb8b3dd81c18a0930be97b"},{"url":"https://git.kernel.org/stable/c/47b1c5d1b0944aa88299f55a846fabaefc756982"},{"url":"https://git.kernel.org/stable/c/cf4a4df38d1747e06fc54f9879bd7a6f4178032f"},{"url":"https://git.kernel.org/stable/c/9853d94b82d303fc4ac37d592a23a154096ecd41"},{"url":"https://git.kernel.org/stable/c/208669df703a25a601f45822b10c413f258bf275"},{"url":"https://git.kernel.org/stable/c/f1ba83755d81c6fc66ac7acd723d238f974091e9"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02035,"ingestedAt":"2026-11-06T15:54:03.913Z","slug":"CVE-2026-43451","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: fix entry leak in bridge verdict error path\n\nnfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue\nentry from the queue data structures, taking ownership of the entry.\nFor PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN\nattributes.  If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN\npresent but NFQA_VLAN_TCI missing), the function returns immediately\nwithout freeing the dequeued entry or its sk_buff.\n\nThis leaks the nf_queue_entry, its associated sk_buff, and all held\nreferences (net_device refcounts, struct net refcount).  Repeated\ntriggering exhausts kernel memory.\n\nFix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict\non the error path, consistent with other error handling in this file.\n\n## Affected\n\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < a907bea273b60d3e604ec4e8e1f6c49954805794`\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 0b18d1b834ab5a5009be70b530f978d7989e445b`\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < b38d2b4603fd3dda24eb8b3dd81c18a0930be97b`\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 47b1c5d1b0944aa88299f55a846fabaefc756982`\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < cf4a4df38d1747e06fc54f9879bd7a6f4178032f`\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 9853d94b82d303fc4ac37d592a23a154096ecd41`\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < 208669df703a25a601f45822b10c413f258bf275`\n- `Linux >= 8d45ff22f1b43249f0cf1baafe0262ca10d1666e < f1ba83755d81c6fc66ac7acd723d238f974091e9`\n- `Linux 4.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}