5.5

CVE-2026-43026: linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2026-43026DEBIAN-CVE-2026-43026
Published 01-05-2026Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2026-43026 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.1% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.17%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 41 · Related 39
MGASA-2026-0108MGASA-2026-0110OPENSUSE-SU-2026:20965-1SUSE-SU-2026:22099-1SUSE-SU-2026:22108-1SUSE-SU-2026:22112-1

Timeline

  1. 01-05-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ctnetlink_alloc_expect() allocates expectations from a non-zeroing slab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not present in the netlink message, saved_addr and saved_proto are never initialized. Stale data from a previous slab occupant can then be dumped to userspace by ctnetlink_exp_dump_expect(), which checks these fields to decide whether to emit CTA_EXPECT_NAT. The safe sibling nf_ct_expect_init(), used by the packet path, explicitly zeroes these fields. Zero saved_addr, saved_proto and dir in the else branch, guarded by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when NAT is enabled. Confirmed by priming the expect slab with NAT-bearing expectations, freeing them, creating a new expectation without CTA_EXPECT_NAT, and observing that the ctnetlink dump emits a spurious CTA_EXPECT_NAT containing stale data from the prior allocation.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

+0.04 pp

From 0.13% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < a5a89db6981a1ddf2314bf50cb49db5a3146185f | ≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < 1c2ebdeff8d088a2e47ae25d7b38447249adace2 | ≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < a64b7bf84b4d5ea54218c5d374ec87fff9000f43 | ≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < 2898080c054ea4d6ddfaaf21bbedbc229a9a8376 | ≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < fd002ff2ea030cbfb0188a11b3c60ce7f84485f4 | ≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < 929f7a9a7aad9404a5867216c3f8738232355b38 | ≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < bff0f4f06f12d6d9bc565a3e1378abd4f6f5ce36 | ≥ 076a0ca02644657b13e4af363f487ced2942e9cb, < 35177c6877134a21315f37d57a5577846225623e | 3.4
  • linux_kernel≥ 3.4, < 5.10.253 | ≥ 5.11, < 5.15.203 | ≥ 5.16, < 6.1.168 | ≥ 6.2, < 6.6.134 | ≥ 6.7, < 6.12.81 | ≥ 6.13, < 6.18.22 | ≥ 6.19, < 6.19.12 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.12-1

3 vendors · 160 products

References

42 links
Show all 42 references