CoreCVE
Back

HIGH

netfilter: flowtable: strictly check for maximum number of actions

Published May 8, 2026

Description

The maximum number of flowtable hardware offload actions in IPv6 is:

* ethernet mangling (4 payload actions, 2 for each ethernet address) * SNAT (4 payload actions) * DNAT (4 payload actions) * Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) for QinQ. * Redirect (1 action)

Which makes 17, while the maximum is 16. But act_ct supports for tunnels actions too. Note that payload action operates at 32-bit word level, so mangling an IPv6 address takes 4 payload actions.

Update flow_action_entry_next() calls to check for the maximum number of supported actions.

While at it, rise the maximum number of actions per flow from 16 to 24 so this works fine with IPv6 setups.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (44)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Linux
Published May 8, 2026
Updated Sep 15, 2026
Reserved May 1, 2026
Link CVE-2026-43329

CISA Vulnrichment

No data

NVD

Status Modified
Modified Sep 15, 2026
Link CVE-2026-43329

Red Hat

Severity Important
Public date May 8, 2026
Bugzilla 2468124
Link CVE-2026-43329

ENISA EUVD

Assigner Linux
Published May 8, 2026
Updated Sep 15, 2026
Link EUVD-2026-28613

GitHub

No data