PT-2026-37594 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-43254

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ovpn tcp recv function when processing TCP stream data. The implementation contains two primary flaws: a header offset overflow and unaligned protocol headers. The header offset overflow occurs when using pskb pull with large offsets on coalesced skbs, causing the network header storage to be exceeded and resulting in packet drops. Additionally, extracting packets from arbitrary positions in the TCP stream provides no alignment guarantees, which leads to performance penalties on architectures that lack efficient unaligned access. This is further complicated by a 2-byte length prefix on TCP packets that misaligns subsequent 4-byte opcode and packet ID fields.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-43254

Affected Products

Linux Kernel

References · 11

• https://git.kernel.org/stable/c/d4f687fbbce45b5e88438e89b5e26c0c15847992 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43254 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43254 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43254 · Vendor Advisory
• https://git.kernel.org/stable/c/0315bec883c67fa1413c61e504a28dc5bd02eb37 · Patch
• https://git.kernel.org/stable/c/7dba6cd7fb168d7615194a631c9c100c1c224131 · Patch
• https://ubuntu.com/security/CVE-2026-43254 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43254 · Vendor Advisory
• https://twitter.com/vuldb/status/2052033203716997567 · Twitter Post
• https://git.kernel.org/linus/d4f687fbbce45b5e88438e89b5e26c0c15847992 · Note