Skip to main content

Linux Kernel EUVDEUVD-2026-28760

| CVE-2026-43454 HIGH
2026-05-08 Linux GHSA-f5mr-9pc2-5mcw
Information Disclosure Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 11, 2026 - 08:36 vuln.today
CVSS changed
May 11, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
May 08, 2026 - 16:18 EUVD
CVE Published
May 08, 2026 - 14:22 nvd
UNKNOWN (no severity yet)
CVE Published
May 08, 2026 - 14:22 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: Fix for duplicate device in netdev hooks

When handling NETDEV_REGISTER notification, duplicate device registration must be avoided since the device may have been added by nft_netdev_hook_alloc() already when creating the hook.

AnalysisAI

Privilege escalation in Linux kernel netfilter subsystem allows local authenticated users to achieve high-impact compromise via duplicate netdev hook registration. The vulnerability affects kernel versions 6.16 through early 7.0 releases, with vendor patches available for stable branches 6.18.19, 6.19.9, and mainline 7.0. EPSS score of 0.02% (4th percentile) suggests low observed exploitation likelihood despite CVSS 7.8 severity. No active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis.

Technical ContextAI

This vulnerability resides in the netfilter nf_tables subsystem, specifically the netdev hook management code that handles network device registration events. When the kernel receives a NETDEV_REGISTER notification, the code fails to check whether a device has already been registered through nft_netdev_hook_alloc() during hook creation. This race condition or logic flaw allows duplicate device entries in the netdev hook chain. The CPE strings identify this as affecting the Linux kernel codebase itself (cpe:2.3:a:linux:linux), and the git commit references show fixes were backported to stable kernel series. The underlying issue involves improper resource management in the netfilter framework that processes network packets at various kernel hooks, potentially allowing manipulation of packet filtering rules or hook execution order.

RemediationAI

Upgrade to patched Linux kernel versions: 6.18.19 or later for the 6.18.x series, 6.19.9 or later for 6.19.x series, or 7.0 with the fix commit for mainline kernels. Specific fix commits are documented at https://git.kernel.org/stable/c/2041cdb078041611510fc189410bc70b29f688fb (6.18 branch), https://git.kernel.org/stable/c/b7cdc5a97d02c943f4bdde4d5767ad0c13cad92b (6.19 branch), and https://git.kernel.org/stable/c/6d2a95c6890577cc3eab2b20018e16850d7fb094 (mainline). If immediate patching is not feasible, restrict local user access on affected systems, disable unprivileged user namespaces via kernel.unprivileged_userns_clone=0 sysctl (may break containerized applications), and implement mandatory access controls (SELinux/AppArmor) to limit netfilter configuration capabilities to trusted processes only. Monitor for unexpected nft_netdev_hook_alloc() calls or duplicate netdev registrations in kernel logs. Compensating controls reduce but do not eliminate risk; patching remains the definitive solution.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-28760 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy