---
id: CVE-2026-43084
title: 'netfilter: nfnetlink_queue: make hash table per queue'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nfnetlink_queue: make hash table per queue

  Sharing a global hash table among all queues is tempting, but
  it can cause crash:

  BUG: KASAN: slab-use-after-fre…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 371de2bef6582a3f58049b3d18e190924af9c9a0 <
    22730cb96093b5be0609063bbb1923dbecd61252
  - >-
    Linux >= 870e3e63da8e88daffe9d692a025c711658018a8 <
    41e3652a178cb0eecd48e0e6e27fbb73a004046a
  - >-
    Linux >= 70e2e3ce4f6841e12ec1c104fc76c0e707398ec4 <
    9e5ebef91120d2764aefe557c3a484b6288f341f
  - >-
    Linux >= e19079adcd26a25d7d3e586b1837493361fdf8b6 <
    936206e3f6ff411581e615e930263d6f8b78df9d
  - Linux >= 6.12.75 < 6.12.83
  - Linux >= 6.18.14 < 6.18.24
  - Linux >= 6.19.4 < 6.19.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:14:29.678333Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:32.064Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43084'
references:
  - url: 'https://git.kernel.org/stable/c/22730cb96093b5be0609063bbb1923dbecd61252'
  - url: 'https://git.kernel.org/stable/c/41e3652a178cb0eecd48e0e6e27fbb73a004046a'
  - url: 'https://git.kernel.org/stable/c/9e5ebef91120d2764aefe557c3a484b6288f341f'
  - url: 'https://git.kernel.org/stable/c/936206e3f6ff411581e615e930263d6f8b78df9d'
tags:
  - cve.org
epss: 0.0017
epssPercentile: 0.05946
ingestedAt: '2026-10-16T17:24:46.682Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: make hash table per queue

Sharing a global hash table among all queues is tempting, but
it can cause crash:

BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]
[..]
 nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]
 nfnetlink_rcv_msg+0x46a/0x930
 kmem_cache_alloc_node_noprof+0x11e/0x450

struct nf_queue_entry is freed via kfree, but parallel cpu can still
encounter such an nf_queue_entry when walking the list.

Alternative fix is to free the nf_queue_entry via kfree_rcu() instead,
but as we have to alloc/free for each skb this will cause more mem
pressure.

## Affected

- `Linux >= 371de2bef6582a3f58049b3d18e190924af9c9a0 < 22730cb96093b5be0609063bbb1923dbecd61252`
- `Linux >= 870e3e63da8e88daffe9d692a025c711658018a8 < 41e3652a178cb0eecd48e0e6e27fbb73a004046a`
- `Linux >= 70e2e3ce4f6841e12ec1c104fc76c0e707398ec4 < 9e5ebef91120d2764aefe557c3a484b6288f341f`
- `Linux >= e19079adcd26a25d7d3e586b1837493361fdf8b6 < 936206e3f6ff411581e615e930263d6f8b78df9d`
- `Linux >= 6.12.75 < 6.12.83`
- `Linux >= 6.18.14 < 6.18.24`
- `Linux >= 6.19.4 < 6.19.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.