CVE-2026-43089

Undergoing Analysis Undergoing Analysis - In Progress

Memory Corruption in Linux Kernel XFRM User Subsystem

Publication date: 2026-05-06

Last updated on: 2026-06-01

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_mapping() struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. Fix that up by zeroing out the whole structure before setting individual variables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-06-01

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43089

EUVD

EUVD-2026-27589

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.13 (inc) to 6.18.24 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.14 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.83 (exc)
linux	linux_kernel	From 2.6.29.1 (inc) to 6.6.136 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's xfrm_user component, specifically in the build_mapping() function.

The issue arises because the struct xfrm_usersa_id contains a one-byte padding hole after the proto field. This padding byte is never initialized to zero before the structure is copied out to userspace.

As a result, uninitialized memory data can be leaked to userspace, potentially exposing sensitive information.

The fix involves zeroing out the entire structure before setting individual variables, ensuring no unintended data is leaked.

Impact Analysis

This vulnerability can lead to an information leak where uninitialized memory data is exposed to userspace.

Such leaks can potentially reveal sensitive or confidential information that resides in kernel memory, which could be exploited by attackers to gain insights into the system or escalate privileges.

Hi! I’m here to help you understand CVE-2026-43089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70