PT-2026-37398 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-06-19 · CVE-2026-43088

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the PF KEY export paths where pfkey sockaddr size() is used to reserve sockaddr payload space, resulting in IPv6 addresses occupying 32 bytes. However, the pfkey sockaddr fill() function only initializes the first 28 bytes of struct sockaddr in6, leaving the final 4 aligned bytes uninitialized. This affects export paths that append aligned sockaddr payloads using skb put(), specifically within SADB ACQUIRE, SADB X NAT T NEW MAPPING, and SADB X MIGRATE.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43088

ECHO-B843-9C03-00C3

OESA-2026-2675

OESA-2026-2676

Affected Products

Linux Kernel

References · 81

• https://nvd.nist.gov/vuln/detail/CVE-2026-43465 · Security Note
• https://git.kernel.org/stable/c/11cbf294bac623bd57296f231199193087f57b4a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43216 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45915 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43466 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43071 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31709 · Security Note
• https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45894 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46065 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43088 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43088 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45944 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39781 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38389 · Security Note