Linux Kernel CVE-2026-43036

Exploitation requires local user access (PR:L in CVSS vector) and the ability to create and manipulate raw packet sockets via PF_PACKET interface. Standard kernel build must include GSO functionality (CONFIG_SG and CONFIG_GSO, typically enabled in distributions). The vulnerability is triggered specifically when TCP/IPv4 packets processed through PF_PACKET injection paths reach gso_features_check() with non-linearized skb data, a condition that does not occur in normal network interfaces receiving traffic from the wire. Systems with strict socket permission controls (e.g., capabilities-based restrictions preventing CAP_NET_RAW) are not vulnerable to remote exploitation but local users with socket privileges can still trigger this.

CVSS score of 5.5 with local-only attack vector (AV:L) and low complexity (AC:L) indicates moderate severity limited to local attackers with user privileges (PR:L). However, EPSS percentile of 5% suggests exploitation is unlikely despite the high CVSS, indicating this is a low-priority real-world threat. The vulnerability requires intentional malicious packet crafting via PF_PACKET sockets, not a network-facing exposure. Syzbot detected this via fuzzing rather than active exploitation. The impact is availability only (denial of service through kernel crashes or hangs from uninitializable reads), with no confidentiality or integrity compromise possible. This presents a developer/researcher-facing vulnerability rather than an end-user security risk. The low EPSS combined with local-only scope suggests this should not be prioritized above network-accessible vulnerabilities or those affecting default configurations.

A local user with network socket privileges creates a raw packet socket (PF_PACKET) and injects a crafted IPv4 packet with intentionally malformed or missing header data. When the kernel's GSO code attempts to check the frag_off field via ip_hdr() without bounds validation, it reads from uninitialized kernel memory, triggering KMSAN warnings or kernel crashes. An attacker could repeatably trigger this to cause denial of service on systems with sensitive workloads.