Linux Kernel CVE-2026-43042

Exploitation requires MPLS kernel subsystem enabled (CONFIG_MPLS compiled in or loaded as module), which is not default on general-purpose Linux distributions but common on network infrastructure devices. Attack requires local authenticated access with at least CAP_NET_ADMIN capability or root privileges to manipulate MPLS label tables via netlink sockets. Additionally, exploitation depends on successful race condition timing between resize_platform_label_table operations and RCU-protected read paths, requiring some degree of control over packet processing timing or route enumeration operations. Limiting factors include: local-only attack vector (AV:L), low privileges still require CAP_NET_ADMIN for MPLS configuration, specialized networking workload (MPLS not ubiquitous), and race condition complexity (AC:L reflects ease once conditions met, not ease of meeting conditions). Most desktop/server Linux systems are not affected due to absence of MPLS configuration.

Real-world exploitation risk is LOW despite the 7.1 CVSS score. The CVSS vector (AV:L/AC:L/PR:L) indicates local access with low-privileged authentication is required, significantly limiting attack surface compared to network-exploitable vulnerabilities. The EPSS score of 0.02% (5th percentile) suggests negligible observed exploitation activity. Exploitation requires: (1) local system access with at least low privileges, (2) ability to trigger MPLS label table operations, (3) precise race condition timing to trigger the resize during RCU read operations, and (4) MPLS functionality enabled in the kernel (not default on most general-purpose Linux systems). The C:H/I:N/A:H impact pattern indicates potential information disclosure (memory contents leak) or crash, but no integrity compromise or privilege escalation vector. Patch availability from upstream kernel maintainers further reduces risk for organizations maintaining current kernel versions. This is primarily a concern for network infrastructure devices and specialized routing platforms actively using MPLS, not general-purpose servers or workstations. The vulnerability requires the MPLS subsystem to be compiled into the kernel and actively configured, which limits exposure to specialized networking environments.

A local attacker with low-privileged shell access on an MPLS-enabled Linux router triggers rapid MPLS label table resizes via netlink commands (ip -M route operations) while simultaneously forcing packet forwarding through mpls_forward or triggering route dumps via mpls_dump_routes. By winning the race condition, the attacker causes RCU readers to access freed memory regions with stale size metadata, potentially disclosing kernel memory contents (leaked routing table data, adjacent heap objects) or triggering kernel panics for denial of service. No public POC exists at time of analysis.