Skip to main content

Linux Kernel CVE-2026-43139

| EUVDEUVD-2026-27698 HIGH
Use of Uninitialized Resource (CWE-908)
2026-05-06 Linux GHSA-hr53-gf94-w7mp
Information Disclosure Linux
8.6
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 08, 2026 - 13:31 vuln.today
CVSS changed
May 08, 2026 - 13:22 NVD
8.6 (HIGH)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
HIGH 8.6

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: fix uninitialized saddr in xfrm6_get_saddr()

xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source address (returns -EADDRNOTAVAIL), saddr->in6 is left uninitialized, but xfrm6_get_saddr() still returns 0 (success).

This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized address in xfrm_state_find(), triggering KMSAN warning:

============= BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940 xfrm_state_find+0x2424/0xa940 xfrm_resolve_and_create_bundle+0x906/0x5a20 xfrm_lookup_with_ifid+0xcc0/0x3770 xfrm_lookup_route+0x63/0x2b0 ip_route_output_flow+0x1ce/0x270 udp_sendmsg+0x2ce1/0x3400 inet_sendmsg+0x1ef/0x2a0 __sock_sendmsg+0x278/0x3d0 __sys_sendto+0x593/0x720 __x64_sys_sendto+0x130/0x200 x64_sys_call+0x332b/0x3e70 do_syscall_64+0xd3/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable tmp.i.i created at: xfrm_resolve_and_create_bundle+0x3e3/0x5a20 xfrm_lookup_with_ifid+0xcc0/0x3770 =============

Fix by checking the return value of ipv6_dev_get_saddr() and propagating the error.

AnalysisAI

Uninitialized memory use in Linux Kernel's xfrm6_get_saddr() function allows remote attackers to trigger information disclosure and system instability via crafted IPv6 traffic. The vulnerability affects multiple Long-Term Support (LTS) branches from 2.6.19 through 6.19.6, with vendor-released patches available for 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. EPSS score of 0.02% indicates low observed exploitation probability despite the network-accessible attack vector and lack of required authentication. Not listed in CISA KEV, and no public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability exists in the Linux kernel's IPsec implementation, specifically in the IPv6 transform state management code (xfrm6). The xfrm6_get_saddr() function calls ipv6_dev_get_saddr() to obtain a suitable source IPv6 address but fails to validate the return value. When ipv6_dev_get_saddr() cannot find an appropriate address (returning -EADDRNOTAVAIL), the function leaves the saddr->in6 structure uninitialized yet still returns success (0). This uninitialized memory is subsequently used by xfrm_tmpl_resolve_one() and xfrm_state_find() during IPsec policy resolution, leading to use of uninitialized kernel memory. The Kernel Memory Sanitizer (KMSAN) detected this condition during UDP transmission over IPv6 with IPsec transforms. Affected CPE strings (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) indicate widespread impact across kernel versions introduced at commit a1e59abf824969554b90facd44a4ab16e265afa4 (kernel 2.6.19 era). The bug represents a classic initialization failure pattern in kernel network stack error handling paths.

RemediationAI

Upgrade to vendor-released patched kernel versions: 5.10.252 or later for 5.10.x LTS branch, 5.15.202+ for 5.15.x LTS, 6.1.165+ for 6.1.x LTS, 6.6.128+ for 6.6.x LTS, 6.12.75+ for 6.12.x, 6.18.16+ for 6.18.x, 6.19.6+ for 6.19.x, or upgrade to mainline 7.0. Patches available at https://git.kernel.org/stable/ with commits documented in NVD references at https://nvd.nist.gov/vuln/detail/CVE-2026-43139. Organizations unable to immediately patch can implement compensating controls: restrict IPv6 traffic to trusted sources via ip6tables/nftables firewall rules (trade-off: limits IPv6 service availability), disable IPv6 on affected systems if not operationally required via sysctl net.ipv6.conf.all.disable_ipv6=1 (trade-off: eliminates dual-stack capability), or disable IPsec transforms on IPv6 interfaces if not essential (trade-off: removes IPsec encryption for IPv6 traffic). Monitor kernel logs for KMSAN warnings or xfrm-related errors as potential exploitation indicators. Note that compensating controls do not address the root cause and should be considered temporary until patching is feasible.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43139 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy