Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can leave queued network packets pointing to connection-tracking objects after those objects are removed. This stale reference could undermine system confidentiality, integrity, and availability. Exploitation requires local access and privileges, so exposed multi-user or delegated network-management systems deserve the fastest attention.
Executive priority
Prioritize affected shared, container-hosting, or delegated-administration Linux systems where local users can influence networking. Patch through normal emergency kernel processes after vendor confirmation. Internet exposure alone does not establish exploitability, but the potential kernel-level impact supports prompt remediation.
Technical view
Packets held in NFQUEUE may retain references to nftables connection-tracking zone templates, timeout policies, or helpers. Removing those dependencies can leave stale references. The stable-kernel fix drops affected queued packets during object removal. CVSS 3.1 is 7.8: local, low complexity, low privileges, no user interaction, with high potential impact.
Likely exposure
The bundle identifies affected Linux kernel branches spanning 4.19 through 7.0. Practical exposure depends on kernel packaging, backports, NFQUEUE use, nftables connection tracking, and whether referenced objects can be removed while packets remain queued. The supplied version data does not establish precise distribution package ranges.
Exploitation context
No active exploitation is established: the bundle says this CVE is not in KEV and provides no cited exploitation report. The CVSS vector describes a local, low-privilege attack with low complexity and no user interaction. The sources do not establish public exploit availability or a demonstrated attack path.
Researcher notes
The source describes stale references during concurrent queueing and dependency removal but does not name a CWE or document exploitation. The affected-version array appears to mix release boundaries and a commit identifier, so distro-level conclusions require vendor mapping. Review the eight stable commits for branch-specific backports without assuming identical applicability.
Mitigation direction
- Update to a distribution-supported kernel containing the applicable Linux stable fix.
- Check distribution security guidance because package versions may include backported fixes.
- Until updated, restrict privileges permitting nftables, NFQUEUE, module, or connection-tracking object changes.
- Avoid removing referenced connection-tracking objects while packets remain queued, where operationally feasible.
Validation and detection
- Inventory running kernel and package versions across Linux hosts.
- Confirm the installed package contains the relevant stable commit or vendor backport.
- Identify systems using nftables connection tracking and NFQUEUE.
- Review who can modify timeout policies, helpers, zones, modules, or network namespaces.
- Reboot after kernel installation and verify the fixed kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43060 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8a64e76933672b08bd85b63086f33432070fd729CVE reference, Linux
- https://git.kernel.org/stable/c/3da0b946835f33bf36b459ead764c61a761e689bCVE reference, Linux
- https://git.kernel.org/stable/c/ab50302190b303f847c4eba0e31a01a56dec596eCVE reference, Linux
- https://git.kernel.org/stable/c/e68a8db3a0546482b34e9ca5ca886bcf73eb37bbCVE reference, Linux
- https://git.kernel.org/stable/c/6802ff8beceb9c4254318e81c1395720438f2cc2CVE reference, Linux
- https://git.kernel.org/stable/c/f29a055e4f593e577805b41228b142b58f48df1bCVE reference, Linux
- https://git.kernel.org/stable/c/77da55dee67720e2b8d2db49a53334e6c017ee7bCVE reference, Linux
- https://git.kernel.org/stable/c/36eae0956f659e48d5366d9b083d9417f3263ddcCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.