CVE-2026-43244
Memory Corruption in Linux Kernel KCM
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem. It occurs when sending messages using kcm_sendmsg(). When the maximum number of fragments (MAX_SKB_FRAGS) is reached in the current socket buffer (skb), a new skb (tskb) is allocated and linked into a fragment list before copying data. If the data copy fails (for example, due to a user memory fault), the new skb remains in the fragment list but contains zero fragments.
For SOCK_SEQPACKET sockets, partial data may have already been copied, and the error path saves this partial message for later completion. However, because the zero-fragment skb remains linked, when the code later walks the fragment list, it triggers a warning (WARN_ON) due to the unexpected zero fragments.
The root cause is that KCM was missing cleanup code to unlink and free these zero-fragment skbs on error, unlike TCP which has similar cleanup. The fix involves tracking the predecessor skb and unlinking the zero-fragment skb efficiently on error to prevent this condition.
How can this vulnerability impact me? :
This vulnerability can cause warnings and potential instability in the kernel's networking subsystem when processing messages with zero-fragment skbs in the fragment list. It may lead to log flooding due to repeated warnings, which can obscure other important log messages.
While the description does not explicitly mention security impacts like data corruption or privilege escalation, the presence of zero-fragment skbs could potentially cause unexpected behavior in message handling or resource leaks if not properly cleaned up.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a warning triggered in the Linux kernel's kcm_write_msgs() function when processing a message with a zero-fragment skb in the frag_list.
Detection can be done by monitoring kernel logs for the warning message triggered by WARN_ON(!skb_shinfo(skb)->nr_frags) or WARN_ON_ONCE in newer kernels.
Since the issue relates to kernel warnings, you can check the kernel ring buffer or system logs using commands such as:
- dmesg | grep -i kcm
- journalctl -k | grep -i kcm
- journalctl -k | grep WARN_ON
Additionally, reproducing the issue requires sending partial messages via SOCK_SEQPACKET sockets that trigger the zero-fragment skb condition, but no specific detection commands are provided.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed in the Linux kernel by properly unlinking and freeing zero-fragment skb entries in the frag_list on error paths.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix for this vulnerability.
- Monitor kernel logs for warnings related to kcm_write_msgs() to detect if the issue is occurring.
- Avoid using or limit use of KCM (Kernel Connection Multiplexor) sockets if possible until the patch is applied.
No other immediate workarounds or configuration changes are described.