PT-2026-37548 · Linux+2 · Linux+91

Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-43208

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists where the set rps cpu() function incorrectly assumes that the Receive Packet Steering (RPS) table for each receive queue is of a constant size and does not change. By passing flow id to set rps cpu() based on a value computed by get rps cpu(), the system is susceptible to out-of-bound access and potential system crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-43208

Affected Products

Linux

Linux-Allwinner-5.19

Linux-Aws-5.0

Linux-Aws-5.11

Linux-Aws-5.13

Linux-Aws-5.19

Linux-Aws-5.3

Linux-Aws-5.8

Linux-Aws-6.14

Linux-Aws-6.2

Linux-Aws-6.5

Linux-Azure

Linux-Azure-5.11

Linux-Azure-5.13

Linux-Azure-5.19

Linux-Azure-5.3

Linux-Azure-5.8

Linux-Azure-6.11

Linux-Azure-6.2

Linux-Azure-6.5

Linux-Azure-Edge

Linux-Azure-Fde

Linux-Azure-Fde-5.19

Linux-Azure-Fde-6.2

Linux-Gcp

Linux-Gcp-5.11

Linux-Gcp-5.13

Linux-Gcp-5.19

Linux-Gcp-5.3

Linux-Gcp-5.8

Linux-Gcp-6.11

Linux-Gcp-6.14

Linux-Gcp-6.2

Linux-Gcp-6.5

Linux-Gke

Linux-Gke-4.15

Linux-Gkeop-5.15

Linux-Gke-5.4

Linux-Gkeop

Linux-Hwe

Linux-Hwe-5.11

Linux-Hwe-5.13

Linux-Hwe-5.19

Linux-Hwe-5.8

Linux-Hwe-6.11

Linux-Hwe-6.14

Linux-Hwe-6.2

Linux-Hwe-6.5

Linux-Hwe-Edge

Linux-Intel-5.13

Linux-Intel-Iot-Realtime

Linux-Lowlatency-Hwe-5.19

Linux-Lowlatency-Hwe-6.11

Linux-Lowlatency-Hwe-6.2

Linux-Lowlatency-Hwe-6.5

Linux-Nvidia

Linux-Nvidia-6.11

Linux-Nvidia-6.2

Linux-Nvidia-6.5

Linux-Oem

Linux-Oem-5.10

Linux-Oem-5.13

Linux-Oem-5.14

Linux-Oem-5.17

Linux-Oem-5.6

Linux-Oem-6.0

Linux-Oem-6.1

Linux-Oem-6.11

Linux-Oem-6.14

Linux-Oem-6.5

Linux-Oem-6.8

Linux-Oracle-5.0

Linux-Oracle-5.11

Linux-Oracle-5.13

Linux-Oracle-5.3

Linux-Oracle-5.8

Linux-Oracle-6.14

Linux-Oracle-6.5

Linux-Raspi-Realtime

Linux-Raspi2

Linux-Realtime

Linux-Realtime-6.14

Linux-Riscv

Linux-Riscv-5.11

Linux-Riscv-5.19

Linux-Riscv-5.8

Linux-Riscv-6.14

Linux-Riscv-6.5

Linux-Starfive-5.19

Linux-Starfive-6.2

Linux-Starfive-6.5

Linux Kernel

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43208 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43208 · Security Note
• https://git.kernel.org/stable/c/5455a232edea6b946b99449f15ca771a8874a5a6 · Patch
• https://git.kernel.org/stable/c/ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43208 · Security Note
• https://git.kernel.org/stable/c/8a8a9fac9efa6423fd74938b940cb7d731780718 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43208 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43208 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43208 · Vendor Advisory
• https://twitter.com/lyrie_ai/status/2054757718192222502 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054757719106560045 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054757719987376299 · Twitter Post
• https://git.kernel.org/linus/8a8a9fac9efa6423fd74938b940cb7d731780718 · Note
• https://twitter.com/lyrie_ai/status/2054757720905875893 · Twitter Post