Skip to main content

Linux Kernel CVE-2026-43445

| EUVDEUVD-2026-28751 MEDIUM
Memory Leak (CWE-401)
2026-05-08 Linux GHSA-fg4c-9xcm-vp9q
Linux Denial Of Service Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 21, 2026 - 16:53 vuln.today
CVSS changed
May 21, 2026 - 16:52 NVD
5.5 (MEDIUM)
Patch available
May 08, 2026 - 16:18 EUVD
CVE Published
May 08, 2026 - 14:22 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

e1000/e1000e: Fix leak in DMA error cleanup

If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb.

Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak.

In these commits, a faulty while condition caused an infinite loop in dma_error: Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver") Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver")

Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error.

This issue may still exist in the igbvf driver, but I did not address it in this patch.

AnalysisAI

DMA mapping resource leak in Linux kernel e1000 and e1000e Intel Ethernet drivers results in local denial-of-service conditions via memory exhaustion. The flaw originates from an off-by-one error in the TX buffer error-cleanup path (dma_error), introduced by commit c1fa347f20f1 which fixed an infinite loop but simultaneously decremented the unmap counter prematurely - causing exactly one DMA mapping to leak per failed multi-buffer TX operation. No public exploit has been identified and no active exploitation is confirmed (not in CISA KEV); EPSS of 0.02% (7th percentile) reflects extremely low weaponization probability.

Technical ContextAI

The e1000 and e1000e drivers manage Intel PRO/1000 and similar gigabit Ethernet adapters in the Linux kernel. During packet transmission, the driver maps sk_buff (socket buffer) data segments into DMA-addressable memory. If any mapping in a sequence fails, the dma_error cleanup path must unmap all previously successful mappings for that skb. CWE-401 (Missing Release of Memory after Effective Lifetime) describes the root cause: commit c1fa347f20f17f14a4a1575727fa24340e8a9117 corrected a faulty while-loop condition that caused an infinite loop in dma_error, but introduced a pre-decrement of the count variable before the unmap while-loop - creating an off-by-one where the last successfully-mapped DMA buffer is never unmapped. The CVE description also notes the igbvf driver may harbor the same pattern but was not patched in this fix. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary remediation is to upgrade the Linux kernel to a patched stable release: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, or 7.0. Upstream fix commits are available in the Linux stable tree, including https://git.kernel.org/stable/c/fa5ba9867a55e640df0dc79bf0199770fb043f03, https://git.kernel.org/stable/c/10b5e65959e955a1c8894e0a5413944b5a70204a, https://git.kernel.org/stable/c/e94eaef11142b01f77bf8ba4d0b59720b7858109, and related commits for other branches. If patching is not immediately feasible and the affected Intel e1000/e1000e NICs are non-essential, unloading the driver modules via 'modprobe -r e1000e e1000' will eliminate the attack surface - though this will disable the associated network interfaces. Additionally, operators should assess the igbvf driver independently, as the CVE description explicitly notes it may carry the same off-by-one defect without an available fix in this patch set.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43445 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy