CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation
In the Linux kernel, the following vulnerability has been resolved:
xfrm: account XFRMAIFID in aevent size calculation
xfrmgetae() allocates the reply skb with xfrmaeventmsgsize(), then buildaevent() appends attributes including XFRMAIFID when x->ifid is set.
xfrmaeventmsgsize() does not include space for XFRMAIFID. For states with ifid, buildaevent() can fail with -EMSGSIZE and hit BUGON(err < 0) in xfrmgetae(), turning a malformed netlink interaction into a kernel panic.
Account XFRMAIFID in the size calculation unconditionally and replace the BUGON with normal error unwinding.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43107?
CVE-2026-43107 has a moderate severity level due to potential memory allocation issues in the Linux kernel.
How do I fix CVE-2026-43107?
To fix CVE-2026-43107, update to the latest version of the Linux kernel that contains the security patch addressing this vulnerability.
What are the potential impacts of CVE-2026-43107?
CVE-2026-43107 may lead to denial of service or unexpected behavior in the networking stack due to incorrect event size calculations.
Which systems are affected by CVE-2026-43107?
CVE-2026-43107 affects systems running vulnerable versions of the Linux kernel that utilize the xfrm functionality.
Is CVE-2026-43107 publicly known?
Yes, CVE-2026-43107 is a public vulnerability identified and cataloged in the Common Vulnerabilities and Exposures database.