Junglewise Threat Intelligence

CVE-2026-43026: Linux Kernel Netfilter uninitialized memory use in ctnetlink

CVE-2026-43026 · Severity: medium · CVSS 5.5 · Published 2026-05-01

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or instability. The issue occurs in the Netfilter component, which handles network traffic filtering and Network Address Translation (NAT). By sending specific network management messages, an attacker could trigger the use of uninitialized memory, potentially leading to a denial-of-service condition.

Technical details

A vulnerability exists in the Linux kernel netfilter subsystem within the ctnetlink_alloc_expect() function. The function allocates expectations from a non-zeroing slab cache via nf_ct_expect_alloc(). When the CTA_EXPECT_NAT attribute is missing from a netlink message, the saved_addr and saved_proto fields remain uninitialized. Consequently, ctnetlink_exp_dump_expect() may dump stale data from previous slab occupants to userspace or cause unexpected behavior. The fix involves explicitly zeroing these fields when CTA_EXPECT_NAT is absent, provided CONFIG_NF_NAT is enabled. This is primarily a local information leak or denial-of-service vector.

Affected products

  • Linux Linux Kernel Fixed in 1c2ebde, 2898080, 35177c6, 929f7a9, a5a89db, a64b7bf, bff0f4f, fd002ff
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-03-31: other: Patch authored
  • 2026-04-01: patched: Initial patch committed to mainline
  • 2026-05-01: disclosed: CVE published
  • 2026-07-14: advisory: Siemens product impact confirmed

References

Related threats