CVE-2026-43089
Undergoing Analysis Undergoing Analysis - In Progress
Memory Corruption in Linux Kernel XFRM User Subsystem

Publication date: 2026-05-06

Last updated on: 2026-06-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_mapping() struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. Fix that up by zeroing out the whole structure before setting individual variables.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-06-01
Generated
2026-06-16
AI Q&A
2026-05-06
EPSS Evaluated
2026-06-15
NVD
CVE-2026-43089
EUVD
EUVD-2026-27589
Affected Vendors & Products
Showing 11 associated CPEs
Vendor Product Version / Range
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.24 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.14 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.83 (exc)
linux linux_kernel From 2.6.29.1 (inc) to 6.6.136 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's xfrm_user component, specifically in the build_mapping() function.

The issue arises because the struct xfrm_usersa_id contains a one-byte padding hole after the proto field. This padding byte is never initialized to zero before the structure is copied out to userspace.

As a result, uninitialized memory data can be leaked to userspace, potentially exposing sensitive information.

The fix involves zeroing out the entire structure before setting individual variables, ensuring no unintended data is leaked.

Impact Analysis

This vulnerability can lead to an information leak where uninitialized memory data is exposed to userspace.

Such leaks can potentially reveal sensitive or confidential information that resides in kernel memory, which could be exploited by attackers to gain insights into the system or escalate privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart