---
id: CVE-2026-43060
title: 'netfilter: nft_ct: drop pending enqueued packets on removal'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_ct: drop pending enqueued packets on removal

  Packets sitting in nfqueue might hold a reference to:

  - templates that specify the conntrack zone, because…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    8a64e76933672b08bd85b63086f33432070fd729
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    3da0b946835f33bf36b459ead764c61a761e689b
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    ab50302190b303f847c4eba0e31a01a56dec596e
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    e68a8db3a0546482b34e9ca5ca886bcf73eb37bb
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    6802ff8beceb9c4254318e81c1395720438f2cc2
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    f29a055e4f593e577805b41228b142b58f48df1b
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    77da55dee67720e2b8d2db49a53334e6c017ee7b
  - >-
    Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 <
    36eae0956f659e48d5366d9b083d9417f3263ddc
  - Linux 4.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:14:09.661568Z'
published: '2026-05-05'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:30.754Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43060'
references:
  - url: 'https://git.kernel.org/stable/c/8a64e76933672b08bd85b63086f33432070fd729'
  - url: 'https://git.kernel.org/stable/c/3da0b946835f33bf36b459ead764c61a761e689b'
  - url: 'https://git.kernel.org/stable/c/ab50302190b303f847c4eba0e31a01a56dec596e'
  - url: 'https://git.kernel.org/stable/c/e68a8db3a0546482b34e9ca5ca886bcf73eb37bb'
  - url: 'https://git.kernel.org/stable/c/6802ff8beceb9c4254318e81c1395720438f2cc2'
  - url: 'https://git.kernel.org/stable/c/f29a055e4f593e577805b41228b142b58f48df1b'
  - url: 'https://git.kernel.org/stable/c/77da55dee67720e2b8d2db49a53334e6c017ee7b'
  - url: 'https://git.kernel.org/stable/c/36eae0956f659e48d5366d9b083d9417f3263ddc'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06638
ingestedAt: '2026-10-16T17:24:46.680Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: drop pending enqueued packets on removal

Packets sitting in nfqueue might hold a reference to:

- templates that specify the conntrack zone, because a percpu area is
  used and module removal is possible.
- conntrack timeout policies and helper, where object removal leave
  a stale reference.

Since these objects can just go away, drop enqueued packets to avoid
stale reference to them.

If there is a need for finer grain removal, this logic can be revisited
to make selective packet drop upon dependencies.

## Affected

- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < 8a64e76933672b08bd85b63086f33432070fd729`
- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < 3da0b946835f33bf36b459ead764c61a761e689b`
- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < ab50302190b303f847c4eba0e31a01a56dec596e`
- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < e68a8db3a0546482b34e9ca5ca886bcf73eb37bb`
- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < 6802ff8beceb9c4254318e81c1395720438f2cc2`
- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < f29a055e4f593e577805b41228b142b58f48df1b`
- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < 77da55dee67720e2b8d2db49a53334e6c017ee7b`
- `Linux >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < 36eae0956f659e48d5366d9b083d9417f3263ddc`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.