Linux Kernel CVE-2026-43451

The vulnerability resides in net/netfilter/nfnetlink_queue.c (CPE: cpe:2.3:a:linux:linux) and is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The netfilter nfnetlink_queue subsystem allows userspace processes to receive and verdict on network packets via netlink. nfqnl_recv_verdict() calls find_dequeue_entry() to remove a packet entry from the queue, transferring ownership to the caller. For PF_BRIDGE (bridged network layer) packets, it subsequently invokes nfqa_parse_bridge() to extract VLAN attributes. When NFQA_VLAN is present in the netlink message but the required NFQA_VLAN_TCI sub-attribute is absent, nfqa_parse_bridge() returns -EINVAL. The caller returns immediately without invoking nfqnl_reinject() to release the entry, permanently leaking the nf_queue_entry struct, its sk_buff, and all reference-counted kernel objects pinned by the entry. The fix applies nfqnl_reinject() with NF_DROP on this error path, consistent with how other error cases in the same file are handled. The vulnerability was introduced in commit 8d45ff22f1b43249f0cf1baafe0262ca10d1666e, traceable to Linux 4.7.