PT-2026-37412 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-11 · CVE-2026-43102

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak exists in the Linux kernel within the airoha qdma rx process() function. When an error occurs in buffers belonging to the non-linear part of the socket buffer (skb)—such as incorrect payload length reported by the NIC or exhaustion of available fragments—the page pool fragment is not linked to the skb. Consequently, the fragment is not returned to the pool during the error path of the airoha qdma rx process() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-43102

Affected Products

Linux Kernel

References · 12

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43102 · Security Note
• https://git.kernel.org/stable/c/4429b761874fb9c7767d12d98913a467ef2654f1 · Patch
• https://git.kernel.org/stable/c/285fa6b1e03cff78ead0383e1b259c44b95faf90 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43102 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43102 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43102 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43102 · Vendor Advisory
• https://git.kernel.org/stable/c/7ee0063fbab8aea8f4e4e3165f541bf898b77b80 · Patch
• https://git.kernel.org/linus/285fa6b1e03cff78ead0383e1b259c44b95faf90 · Note
• https://t.me/cveNotify/163070 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052020666925244901 · Twitter Post