Skip to content
Heist/ feed
Back to feed
UnratedFix available

netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff. This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory. Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.253, 5.15.203, 6.1.167, 6.12.78, 6.18.19, 6.19.9, 6.6.130
CVEs
CVE-2026-43451
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 00:55 UTC · Revision 1

Source evidence

netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path

core-osv · Original source

Published 8 May 2026, 14:22 UTC

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff. This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory. Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.

osv:CVE-2026-43451

Kernel

Fixed versions: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9

Complete source record
{
  "id": "6404d9b1bf5c4f31766cce2ffe16b74450a871f67a5caaf266543fdc006c9b6e",
  "url": "https://osv.dev/vulnerability/CVE-2026-43451",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff. This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory. Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.",
    "evidence": "osv:CVE-2026-43451",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.253",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.203",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.167",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.130",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.78",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.19",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.19.9",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-43451",
      "aliases": [
        "CVE-2026-43451"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8d45ff22f1b43249f0cf1baafe0262ca10d1666e"
                },
                {
                  "fixed": "a907bea273b60d3e604ec4e8e1f6c49954805794"
                },
                {
                  "fixed": "0b18d1b834ab5a5009be70b530f978d7989e445b"
                },
                {
                  "fixed": "b38d2b4603fd3dda24eb8b3dd81c18a0930be97b"
                },
                {
                  "fixed": "47b1c5d1b0944aa88299f55a846fabaefc756982"
                },
                {
                  "fixed": "cf4a4df38d1747e06fc54f9879bd7a6f4178032f"
                },
                {
                  "fixed": "9853d94b82d303fc4ac37d592a23a154096ecd41"
                },
                {
                  "fixed": "208669df703a25a601f45822b10c413f258bf275"
                },
                {
                  "fixed": "f1ba83755d81c6fc66ac7acd723d238f974091e9"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43451.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.7.0"
                },
                {
                  "fixed": "5.10.253"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.203"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.167"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.130"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.78"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.19"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "6.19.9"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43451.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:48.533156989Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0b18d1b834ab5a5009be70b530f978d7989e445b",
        "https://git.kernel.org/stable/c/208669df703a25a601f45822b10c413f258bf275",
        "https://git.kernel.org/stable/c/47b1c5d1b0944aa88299f55a846fabaefc756982",
        "https://git.kernel.org/stable/c/9853d94b82d303fc4ac37d592a23a154096ecd41",
        "https://git.kernel.org/stable/c/a907bea273b60d3e604ec4e8e1f6c49954805794",
        "https://git.kernel.org/stable/c/b38d2b4603fd3dda24eb8b3dd81c18a0930be97b",
        "https://git.kernel.org/stable/c/cf4a4df38d1747e06fc54f9879bd7a6f4178032f",
        "https://git.kernel.org/stable/c/f1ba83755d81c6fc66ac7acd723d238f974091e9",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43451.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-43451",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43451.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-43451",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 516779,
  "published_at": "2026-05-08T14:22:16.716+00:00"
}