PT-2026-43910 · Linux · Linux Kernel

Published 2026-05-27 · Updated 2026-06-16 · CVE-2026-46043

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1

Description An issue exists in the RDMA/rxe component where the rxe rcv() function fails to properly validate the incoming packet length before calculating the payload size. The payload size() calculation subtracts the attacker-controlled BTH pad field and the RXE ICRC SIZE from the packet length. If a packet is short or contains a forged non-zero BTH pad, it can cause an integer underflow, passing a negative or underflowed value to subsequent receive-path processes.

Recommendations Update to version 7.0.11-1.1.

Fix

Related Identifiers

CVE-2026-46043

ECHO-A558-0C0D-D635

OPENSUSE-SU-2026:10954-1

SUSE-SU-2026:22108-1

SUSE-SU-2026:2310-1

SUSE-SU-2026:2331-1

SUSE-SU-2026:2332-1

SUSE-SU-2026:2383-1

SUSE-SU-2026:2421-1

Affected Products

Linux Kernel

References · 495

• https://ubuntu.com/security/CVE-2026-46043 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10954-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46043 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:2332-1 · Vendor Advisory
• https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:2383-1 · Vendor Advisory
• https://git.kernel.org/stable/c/c4376c672c3648d5bdc31dfffc329d07164f93c4 · Patch
• https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-46043 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46043 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2310-1 · Vendor Advisory
• https://git.kernel.org/stable/c/2c0d71ef12f46c57d37bc571f3f2797db7eb50cc · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:2421-1 · Vendor Advisory
• https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520 · Patch
• https://cve.org/CVERecord?id=CVE-2026-46043 · Security Note