CVE-2026-43027

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_helper: pass helper to expect cleanup

nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()

to remove expectations belonging to the helper being unregistered.

However, it passes NULL instead of the helper pointer as the data

argument, so expect_iter_me() never matches any expectation and all

of them survive the cleanup.

After unregister returns, nfnl_cthelper_del() frees the helper

object immediately. Subsequent expectation dumps or packet-driven

init_conntrack() calls then dereference the freed exp->helper,

causing a use-after-free.

Pass the actual helper pointer so expectations referencing it are

properly destroyed before the helper object is freed.

BUG: KASAN: slab-use-after-free in string+0x38f/0x430

Read of size 1 at addr ffff888003b14d20 by task poc/103

Call Trace:

string+0x38f/0x430

vsnprintf+0x3cc/0x1170

seq_printf+0x17a/0x240

exp_seq_show+0x2e5/0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References