PT-2026-37417 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-07 · CVE-2026-43107

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the xfrm component where the xfrm get ae() function allocates a reply socket buffer (skb) using xfrm aevent msgsize(), but the build aevent() function may append additional attributes, such as XFRMA IF ID, when x->if id is set. Because xfrm aevent msgsize() fails to account for the space required by XFRMA IF ID, the process can fail with an -EMSGSIZE error. This triggers a BUG ON(err < 0) condition in xfrm get ae(), which can lead to a kernel panic resulting from a malformed netlink interaction.

Recommendations Update the kernel to a version where XFRMA IF ID is unconditionally included in the size calculation and the BUG ON macro is replaced with normal error unwinding.

Fix

Weakness Enumeration

CWE-131

Related Identifiers

CVE-2026-43107

Affected Products

Linux Kernel

References · 15

• https://security-tracker.debian.org/tracker/CVE-2026-43107 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43107 · Security Note
• https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43107 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43107 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43107 · Vendor Advisory
• https://git.kernel.org/stable/c/58e5735d1a5373652f405a0c16e54ac04aaab0ad · Patch
• https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c · Patch
• https://git.kernel.org/stable/c/7081d46d32312f1a31f0e0e99c6835a394037599 · Patch
• https://ubuntu.com/security/CVE-2026-43107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43107 · Security Note
• https://docs.bell-sw.com/security/cves/CVE-2026-43107 · Note
• https://t.me/CVEtracker/52830 · Telegram Post
• https://git.kernel.org/linus/7081d46d32312f1a31f0e0e99c6835a394037599 · Note
• https://twitter.com/VulmonFeeds/status/2052010427744129047 · Twitter Post