CVE-2026-43036: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43036 is a Linux kernel vulnerability in the network subsystem where the gso_features_check() function unsafely accesses the IPv4 header frag_off field, leading to an uninitialized memory read. The flaw was discovered via Syzbot's KMSAN (Kernel Memory Sanitizer) tooling, which reported an uninit-value warning in gso_features_check() called from netif_skb_features(). It affects Linux kernel versions 4.7 through 6.12.80, 6.13 through 6.18.21, 6.19 through 6.19.11, and 7.0-rc1 through 7.0-rc6. It was published on May 1, 2026, with patches released by May 8, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Github Advisory, Red Hat).

The root cause is classified as CWE-908 (Use of Uninitialized Resource) and CWE-824 (Access of Uninitialized Pointer). The gso_features_check() function reads iph->frag_off via ip_hdr()/inner_ip_hdr() macros to decide whether to clear mangleid_features; however, these macros rely on skb header offsets that are not always safe for direct dereference when packets are injected through PF_PACKET socket paths, potentially accessing uninitialized memory. The fix replaces the direct dereference with skb_header_pointer(), which safely handles both linear and non-linear packet data. Exploitation requires local access and the ability to create PF_PACKET sockets, typically requiring CAP_NET_RAW or equivalent privileges (Github Advisory).

Successful exploitation results in a denial of service — specifically, kernel crashes or system hangs — due to uninitialized memory reads in the GSO (Generic Segmentation Offload) processing path. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H). The scope is confined to the affected system, with no evidence of lateral movement potential (Github Advisory, Red Hat).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), placing it in a very low percentile for near-term exploitation likelihood. Exploitation requires local access with PF_PACKET socket privileges, significantly limiting the attacker pool (Github Advisory).

Patches are available across multiple Linux kernel stable branches. Fixed versions include 6.12.81 (for kernels 4.7–6.12.x), 6.18.22 (for 6.13–6.18.x), 6.19.12 (for 6.19.x), and the mainline 7.0 release. Patch commits are available at the kernel stable repository. As a workaround where immediate patching is not possible, restrict PF_PACKET socket access to trusted users only (e.g., by limiting CAP_NET_RAW capability) (Github Advisory, Red Hat).

Red Hat has acknowledged the vulnerability and published a tracking entry via Bugzilla. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries (Red Hat).