Linux Kernel Shadow Stack Error Handling Flaw

Publication date: 2026-05-06

Last updated on: 2026-05-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: x86: shadow stacks: proper error handling for mmap lock 김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it. So let's fix both issues.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-05-17

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43109

EUVD

EUVD-2026-27629

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.19 (inc) to 6.19.14 (exc)
linux	linux_kernel	From 6.6 (inc) to 6.18.24 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is related to the Linux kernel's x86 shadow stacks feature. Specifically, the function shstk_pop_sigframe() did not properly check for errors returned by mmap_read_lock_killable(), which is an oversight in error handling. Additionally, the functions involved were not marked with the '__must_check' attribute, which would have enforced error checking and prevented this issue.

Hi! I’m here to help you understand CVE-2026-43109. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70