CVE-2026-43208: net: do not pass flow_id to set_rps_cpu()
In the Linux kernel, the following vulnerability has been resolved:
net: do not pass flowid to setrpscpu()
Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change.
Compute flowid in setrpscpu(), do not assume we can use the value computed by getrpscpu(). Otherwise we risk out-of-bound access and/or crashes.
Affected Software
Event History
Frequently Asked Questions
What configurations are implicated?
The issue involves Receive Packet Steering (RPS) tables associated with receive queues. It can occur when RPS table sizes differ between queues or when a table size changes, because a flow identifier calculated for one context may be used for another.
What is the practical impact if the flaw is triggered?
The incorrect flow identifier can lead to an out-of-bounds memory access and/or a kernel crash. The supplied severity vector rates the issue as critical, with network attack vector, low attack complexity, and no required privileges or user interaction.
What remediation information is available?
The issue is described as resolved, and three stable kernel commit references are provided. The supplied information does not identify the affected or fixed Linux kernel version ranges, so those references must be checked against the kernel source or distribution package in use.