Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or potentially execute unauthorized code. The issue exists in the 'netfilter' component, which manages how network traffic is filtered and routed. Specifically, certain complex network configurations (like IPv6 with multiple address translations) could exceed internal limits, leading to memory corruption.
Technical details
A vulnerability in the netfilter flowtable hardware offload support (nf_flow_table_offload.c) stems from an insufficient check on the maximum number of flow actions. In complex IPv6 scenarios involving ethernet mangling, SNAT, DNAT, and Double VLAN (QinQ), the total number of required actions can reach 17, exceeding the previous hardcoded limit of 16. Because the kernel did not strictly validate this limit before incrementing the action counter in flow_action_entry_next(), a local attacker could trigger an out-of-bounds write. The fix introduces a strict check against a new maximum of 24 actions (NF_FLOW_RULE_ACTION_MAX) to accommodate IPv6 requirements and prevent memory corruption.
Affected products
- Linux Linux Kernel 5.5 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-05-08: advisory: Initial disclosure of CVE-2026-43329
- 2026-03-26: patched: Initial patch authored by Pablo Neira Ayuso
References
- https://git.kernel.org/stable/c/504c9456699dcf4d15195ef34a0fa94a80bfc877
- https://git.kernel.org/stable/c/5382bb03e9c33b089d60788478b922a2dca284cc
- https://git.kernel.org/stable/c/57c78bd2e2dd08897acd35b2bf8bcef322e36f5e
- https://git.kernel.org/stable/c/76522fcdbc3a02b568f5d957f7e66fc194abb893
- https://git.kernel.org/stable/c/879959a7a2be814dd57568655eafa3d8f4d0309e
- https://git.kernel.org/stable/c/ead66c77303f760f6c30be96e2e20d5a77cef614
- https://git.kernel.org/stable/c/fe9018d3e94329f1951b00805a8640bc06f56ead