CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xttcpmss: check remaining length before reading optlen
Quoting reporter: In net/netfilter/xttcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining option length.
If the last byte of the option field is not EOL/NOP (0/1), the code attempts to index op[i+1]. In the case where i + 1 == optlen, this causes an out-of-bounds read, accessing memory past the optlen boundary (either reading beyond the stack buffer opt or the following payload).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43190?
CVE-2026-43190 has been classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43190?
To mitigate CVE-2026-43190, update your Linux kernel to the latest stable version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2026-43190?
CVE-2026-43190 affects unpatched versions of the Linux kernel prior to the implementation of the corresponding fix.
What kind of attack does CVE-2026-43190 facilitate?
CVE-2026-43190 can potentially be exploited via specially crafted TCP packets that could lead to arbitrary memory reading or other undefined behavior.
Is CVE-2026-43190 exploitable remotely?
Yes, CVE-2026-43190 is considered to be exploitable remotely, affecting systems that handle incoming TCP packets.