Linux Kernel CVE-2026-43107

The Linux kernel's xfrm subsystem manages IPsec security associations and transforms. The vulnerability occurs in the netlink message handling path where xfrm_get_ae() requests acquire/expire event (AE) statistics for a transform state. The function allocates a reply socket buffer using xfrm_aevent_msgsize() to determine required space, then build_aevent() populates the message with attributes. When an xfrm state has an interface identifier (if_id field), build_aevent() appends the XFRMA_IF_ID attribute. The root cause is improper bounds checking (CWE-131: Incorrect Buffer Size Calculation) - xfrm_aevent_msgsize() does not include space for this optional attribute, causing buffer overflow conditions. The code path is triggered only through netlink XFRM_MSG_GETAE messages, a privileged operation requiring CAP_NET_ADMIN equivalent or local user privileges.