CVE Explorer

CVE-2026-43450

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the l

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:4dddb220328af8fe1bb01f7913af09a1c97f64293735e499a15f3a360e2cf0fb

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nfnetlink_cthelper.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.6"},{"lessThan":"3.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nfnetlink_cthelper.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0605e1985a95d4334a67869aee45a47e82301abf","status":"affected","version":"12f7a505331e6b2754684b509f2ac8f0011ce644","versionType":"git"},{"lessThan":"92441f6d9405a0c18d03f278b395e782f79a4a30","status":"affected","version":"12f7a505331e6b2754684b509f2ac8f0011ce644","versionType":"git"},{"lessThan":"3cc328ffc32ddb389cba7b78b6aa95d995c2876e","status":"affected","version":"12f7a505331…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/affected/0

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a8d3c974406c6976c8485a097516cdf12714bddead25169ee68dff8f87c67359 · sha256:a6fdde625c7474a9… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer