PT-2026-39096 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43435

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the rust binder component where oneway spam detection was flawed. In TreeRange, the spam detection logic executed before the current request was inserted into the tree, meaning new requests were not included in the spam calculation. Additionally, ArrayRange completely lacked detection logic, allowing large spamming transactions to go undetected. This was addressed by moving the logic in TreeRange to occur after range insertion and implementing the low oneway space() function in ArrayRange.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43435

Affected Products

Linux Kernel

References · 12

• https://security-tracker.debian.org/tracker/CVE-2026-43435 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43435 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43435 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43435 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43435 · Security Note
• https://ubuntu.com/security/CVE-2026-43435 · Vendor Advisory
• https://twitter.com/CVEnew/status/2052767635188990360 · Twitter Post
• https://git.kernel.org/linus/4fc87c240b8f30e22b7ebaae29d57105589e1c0b · Note
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://git.kernel.org/stable/c/4fc87c240b8f30e22b7ebaae29d57105589e1c0b · Note
• https://git.kernel.org/stable/c/edf685946c4acbe57cb96f8d5f3c07e9a2e973c8 · Note
• https://git.kernel.org/stable/c/8d34c993a9a156e657e43cb95186980745cc3597 · Note