Is CVE-2026-43024 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43024 being exploited in the wild.

How severe is CVE-2026-43024?

Medium severity, with a CVSS score of 5.5, published 1 May 2026.

Which products and versions are affected?

Linux Kernel All versions prior to the April 2026 patches; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.

Is there a fix for CVE-2026-43024?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-43024 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-43024?

Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43024: Linux Kernel denial of service in netfilter nf_tables

CVE-2026-43024 · Severity: medium · CVSS 5.5 · Published 2026-05-01

A vulnerability was identified in the Linux kernel's networking subsystem (netfilter) that could allow a local user to cause a system crash. The issue stems from how the system handles specific network filtering instructions that are not intended for direct use. This could lead to a denial-of-service condition, impacting the availability of affected systems, including certain industrial controllers.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2026-43024 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43024 being exploited in the wild.
How severe is CVE-2026-43024?: Medium severity, with a CVSS score of 5.5, published 1 May 2026.
Which products and versions are affected?: Linux Kernel All versions prior to the April 2026 patches; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2026-43024?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-43024 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-43024?: Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Linux kernel netfilter subsystem (nf_tables) exists because the nft_verdict_init function in net/netfilter/nf_tables_api.c did not properly validate NF_QUEUE verdicts. While NF_QUEUE is intended to be delivered via the nft_queue expression, an attacker could provide an immediate NF_QUEUE verdict. This is particularly problematic in the ARP family, which does not support queuing but could still reach this code path. A local attacker with sufficient privileges to modify nftables rules can exploit this to trigger unexpected kernel behavior or a denial-of-service (DoS). The issue has been resolved by explicitly rejecting immediate NF_QUEUE verdicts in the verdict initialization logic.

Affected products

Linux Linux Kernel All versions prior to the April 2026 patches
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

2026-03-31: other: Patch authored by Pablo Neira Ayuso
2026-05-01: disclosed
2026-05-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.