CVE-2026-43039: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-43039 is a kernel memory disclosure and memory corruption vulnerability in the Linux kernel's TI ICSSG Ethernet driver (net/ti/icssg-prueth), specifically in the Zero-Copy (ZC) RX dispatch path. The emac_dispatch_skb_zc() function allocates a new socket buffer (skb) via napi_alloc_skb() but never copies actual packet data from the XDP buffer into it, causing uninitialized kernel heap memory to be passed up the network stack and leaked to userspace. A secondary bug causes incorrect skb_mark_for_recycle() usage, corrupting page_pool internal state. Affected versions include Linux kernel 6.19 through 6.19.11 and 7.0-rc1 through 7.0-rc6. It was published on May 1, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-909 (Missing Initialization of Resource). In emac_dispatch_skb_zc(), a new skb is allocated via napi_alloc_skb() but the received packet data from the XDP buffer is never copied into it using skb_copy_to_linear_data(), so the skb contains uninitialized heap memory when passed to the network stack. A second bug in the same function calls skb_mark_for_recycle() on an skb backed by the NAPI page frag allocator rather than page_pool, causing the free path to return pages to a page_pool that does not own them and corrupting its internal state. The non-ZC path (emac_rx_packet) is unaffected because it uses napi_build_skb() to wrap an existing page_pool page directly and correctly marks it for recycle. No public proof-of-concept exploit is known at this time (Github Advisory, Red Hat Bugzilla).

Successful exploitation allows a network-accessible attacker to read sensitive kernel heap contents leaked into received network packets delivered to userspace, potentially exposing cryptographic keys, credentials, or other confidential in-memory data. The incorrect page_pool recycle handling can corrupt kernel memory management state, leading to system instability or denial of service. These impacts are limited to systems running vulnerable Linux kernel versions with the icssg-prueth driver active and Zero-Copy RX functionality enabled, which is specific to Texas Instruments ICSSG hardware (Github Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Github Advisory). The EPSS score is approximately 0.018% (0.000180), indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Update the Linux kernel to version 6.19.12 or later, which incorporates fixes from commits a968438d4fc17ee1dcdc3cfa490dcb5e7709cf76 and 5597dd284ff8c556c0b00f6a34473677426e3f81. If immediate patching is not feasible, consider disabling Zero-Copy RX functionality on affected icssg-prueth interfaces if the driver supports alternative operating modes, and restrict network access to trusted sources to reduce exposure. Red Hat has tracked this issue in Bugzilla but has not yet published a fixed package version (Github Advisory, Red Hat Bugzilla).