CVE-2026-43028

What it actually does

This is a local Linux kernel vulnerability in the netfilter x_tables subsystem caused by insufficient validation of user-supplied table, match, target, or related object names. Names that are not NUL-terminated can be passed into kernel routines that expect C-style strings, potentially causing out-of-bounds reads, kernel memory disclosure, or a kernel fault/panic. Exploitation requires local access and low privileges, but practical reachability may depend on whether an attacker can access netfilter configuration paths, such as through CAP_NET_ADMIN or unprivileged user namespaces.

Why it matters to the business

Successful exploitation could allow a local attacker to crash affected Linux systems or potentially expose sensitive kernel memory, causing service disruption and increasing the risk of further compromise. Internet-facing services are not directly remotely exploitable through this flaw, but shared Linux hosts, container platforms, developer workstations, and systems with unprivileged user namespaces enabled carry higher operational risk. EPSS is currently very low and no CISA KEV listing or public exploit maturity is reported, so remediation should be prioritized through standard kernel patch cycles unless the system allows untrusted local users or containers.

How an attack unfolds

An attacker first obtains local code execution on an affected Linux system, such as a shell, compromised application account, or container with access to netfilter-related capabilities. They then interact with iptables, ip6tables, arptables, ebtables, or compatible netfilter/x_tables interfaces and submit a crafted name buffer that lacks a terminating NUL byte. Vulnerable kernel code treats the attacker-controlled buffer as a C string and may continue reading beyond the intended field boundary. Depending on kernel layout and code path, this can expose adjacent kernel memory to the caller or trigger an invalid memory access that crashes the kernel. Exploitation is most plausible where local users or containers can exercise CAP_NET_ADMIN or where unprivileged user namespaces provide a path to netfilter operations.

How to fix it

Upgrade affected Linux kernels to a vendor release that includes the upstream netfilter x_tables fix requiring NUL termination validation for names. Because no exact fixed package versions were provided, follow the security advisories from the relevant Linux distribution or appliance vendor and deploy the latest supported kernel update. Reboot systems after kernel upgrade unless using a validated live-patching mechanism that explicitly includes this fix. As interim mitigations, restrict local shell access, avoid granting CAP_NET_ADMIN to untrusted users or containers, disable unprivileged user namespaces where operationally feasible, and limit use of privileged containers or host-network containers on multi-tenant systems.

How to confirm the fix worked

Confirm the running kernel package is at or above the version identified as fixed by the operating system vendor, not merely that an updated package is installed on disk. Verify with commands such as uname -r and the distribution package manager, then confirm the system has rebooted into the patched kernel or that live patching is active and covers this issue. Review whether untrusted users, containers, or services have CAP_NET_ADMIN or access to netfilter management paths. Where practical, test that iptables/nftables functionality continues to operate normally after patching and monitor kernel logs for absence of x_tables-related faults under normal firewall rule management activity.

Typical attack path

1. Gain local execution on an affected Linux host, container, or workload.
2. Determine whether netfilter/x_tables operations are reachable, especially via CAP_NET_ADMIN or unprivileged user namespaces.
3. Invoke iptables-family or compatible netfilter interfaces with a crafted non-NUL-terminated name field.
4. Trigger vulnerable kernel string-handling behavior in the x_tables subsystem.
5. Use the resulting behavior to attempt kernel memory disclosure or cause a denial-of-service crash.
6. If memory disclosure is achieved, use leaked kernel information to support further local privilege-escalation attempts.

How to detect it

Look for evidence of local attempts to exercise netfilter/x_tables interfaces immediately before kernel faults, crashes, or unusual firewall-management activity. Useful sources include kernel logs, system journal, auditd, EDR process telemetry, shell history where available, container runtime logs, and privileged command execution logs. Search for kernel oops, panic, general protection fault, or slab/KASAN reports with stack traces referencing x_tables, ip_tables, ip6_tables, arptables, ebtables, or xt_* functions. Also review audit events showing unexpected execution of iptables, ip6tables, arptables, ebtables, nft, iptables-restore, ip6tables-restore, or privileged netfilter manipulation by non-administrative users, application accounts, or containers. There are no known public exploit-specific payload strings from the provided intelligence, so detection should focus on suspicious local netfilter manipulation followed by kernel instability or memory-access faults.

• x_tables
• net/netfilter/x_tables.c
• ip_tables
• ip6_tables
• arp_tables
• ebtables
• xt_find_match
• xt_find_target
• xt_request_find_match
• xt_request_find_target
• iptables-restore
• ip6tables-restore
• arptables
• ebtables
• nft
• BUG: unable to handle kernel
• general protection fault
• kernel panic
• Oops:

What your security team should do

• Inventory Linux systems running kernels that include the affected netfilter x_tables code path, prioritizing multi-user hosts, container hosts, CI runners, Kubernetes nodes, and systems with unprivileged user namespaces enabled.
• Apply vendor kernel updates and reboot into the fixed kernel during the next appropriate maintenance window; accelerate patching for systems with untrusted local users or privileged containers.
• Audit and reduce CAP_NET_ADMIN grants across containers, services, and user accounts.
• Disable unprivileged user namespaces where they are not required, or restrict them using distribution-supported controls.
• Review kernel logs for recent x_tables, ip_tables, ip6_tables, arptables, or ebtables crashes or warnings that may indicate attempted exploitation or stability impact.
• Ensure endpoint monitoring collects kernel logs, auditd events, and privileged command execution involving iptables, ip6tables, arptables, ebtables, nft, and related tooling.
• Track vendor advisories for exact fixed kernel package versions because fixed_versions were not provided in the vulnerability metadata.