CVE-2026-43035
Heap Memory Leak in Linux Kernel Networking Subsystem
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes a kernel heap memory leak to userspace through an uninitialized 4-byte field in netlink messages. Such an information leak could potentially expose sensitive data residing in kernel memory.
Information leaks can impact compliance with data protection regulations like GDPR and HIPAA, which require protection of personal and sensitive data from unauthorized disclosure.
However, the provided information does not specify the exact nature of the leaked data or whether it includes personal or protected health information.
Therefore, while this vulnerability could pose a risk to compliance by enabling unauthorized data exposure, the exact impact on compliance with standards like GDPR or HIPAA cannot be determined from the given information.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's networking code, specifically in the function tc_chain_fill_node which builds netlink messages. The function fails to initialize the tcm_info field of the tcmsg structure to zero. Because the memory allocated for this field is not cleared, it can leak leftover kernel heap memory to userspace through this 4-byte field.
The issue is fixed by zeroing the tcm_info field along with other fields during initialization, preventing the unintended information leak.
How can this vulnerability impact me? :
This vulnerability can lead to an information leak where sensitive kernel memory contents might be exposed to userspace applications. Such leaks can potentially reveal sensitive data or kernel memory layout information, which attackers could use to further compromise the system.