Security readout for executives and security teams
Plain-English summary
A locally authenticated, low-privilege user may trigger an out-of-bounds Linux kernel memory access through Netfilter connection-tracking expectations. The flaw can expose kernel memory and may also affect system integrity or availability. It is rated high severity, but the supplied evidence does not establish remote or active exploitation.
Executive priority
Treat as a high-priority kernel maintenance issue, especially on shared hosts, container platforms, and network appliances. It is not supported as an emergency internet-wide threat because exploitation requires local access and active exploitation is unconfirmed. Patch promptly through supported vendor channels after verifying affected builds.
Technical view
When userspace creates a conntrack expectation with a helper different from the master connection’s helper, validation can reach an out-of-bounds read in nf_ct_expect_related_report. The resolution ignores the userspace-supplied helper and uses the master conntrack helper. CVSS 3.1 is 7.3: local access, low complexity, low privileges, no interaction.
Likely exposure
Exposure is most relevant to Linux systems where a low-privilege local context can access the affected Netfilter conntrack expectation interface. Containers, appliances, and downstream kernels require vendor-specific assessment. The supplied affected-version data is ambiguous and includes commit identifiers, so version strings alone should not determine exposure.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation. A proof-of-concept task appears in the diagnostic trace, showing the flaw was reproduced during validation, but this does not establish public weaponization or attacks. The CVSS vector requires local access and low privileges.
Researcher notes
The vulnerable path involves ctnetlink expectation creation and helper/class validation. Reported impact is reading beyond an expectation object’s boundary; the CVSS assessment also indicates possible limited integrity and high availability effects. Exact affected ranges cannot be confidently reconstructed from the supplied version array, so confirm ancestry or backports against vendor kernels.
Mitigation direction
- Apply a vendor-supported kernel update containing the relevant stable fix.
- Confirm downstream distributions or appliance vendors have backported the correction.
- Restrict unnecessary local and container access to privileged Netfilter interfaces.
- Prioritize internet-facing multi-user hosts despite the vulnerability requiring local access.
Validation and detection
- Inventory running kernel versions and downstream vendor package revisions.
- Match each kernel build against vendor advisories or the referenced stable commits.
- Confirm the deployed kernel ignores explicit helpers for new conntrack expectations.
- Review local privilege boundaries and container capabilities that expose Netfilter management.
- Monitor kernel diagnostics for related KASAN or out-of-bounds fault signatures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43025 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e135f8e8212cbed12a03ab8dec77fa1247139897CVE reference, Linux
- https://git.kernel.org/stable/c/2ea0f35f235f70c133ad61fe05ba013753b978c6CVE reference, Linux
- https://git.kernel.org/stable/c/0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cdCVE reference, Linux
- https://git.kernel.org/stable/c/187b6ec5229ea93cb04c4f6d3b52efc80f513d0dCVE reference, Linux
- https://git.kernel.org/stable/c/21a04c31db4057deec85fcd6cc63d720b38819c3CVE reference, Linux
- https://git.kernel.org/stable/c/917b61fa2042f11e2af4c428e43f08199586633aCVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.