CVE-2026-43042: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43042 is a race condition vulnerability in the Linux kernel's MPLS (Multiprotocol Label Switching) subsystem, specifically in the handling of the platform_label and platform_labels pair. RCU-protected codepaths (mpls_forward, mpls_dump_routes) can observe an inconsistent view of these structures when a concurrent resize operation (resize_platform_label_table, protected by platform_mutex) occurs, leading to out-of-bounds (OOB) memory accesses. The vulnerability affects Linux kernel versions from 4.1 up to (but not including) 6.19.12, as well as 7.0 release candidates (rc1–rc6). It was published on May 1, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) combined with an out-of-bounds read (CWE-125). The MPLS subsystem maintains a platform_labels count and a platform_label array; when resize_platform_label_table runs under platform_mutex, it can update these two values non-atomically from the perspective of RCU readers. A local attacker with low privileges can trigger concurrent MPLS forwarding or route-dumping operations alongside a label table resize, causing the kernel to read memory beyond the bounds of the label array. The mpls_label_ok function is also susceptible to this inconsistency, though the existing double-check in mpls_route_add and mpls_route_del mitigates that specific path. The fix introduces a seqcount mechanism to ensure readers obtain a consistent snapshot of both values (Github Advisory, Red Hat Bugzilla).

Successful exploitation can result in kernel crashes (denial of service), information disclosure through out-of-bounds memory reads, or potentially local privilege escalation depending on memory layout at the time of exploitation. The vulnerability is limited to systems with MPLS functionality enabled and requires a local attacker with at least low-privilege access to trigger the race condition. Confidentiality and availability are both rated High impact, while integrity is unaffected (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (4th percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local access and the ability to trigger concurrent MPLS operations, which limits the practical attack surface.

The Linux kernel has been patched in versions 6.19.12 and 7.0 (stable). Two upstream commits address the issue by introducing a seqcount to protect the platform_labels/platform_label pair: 5bb3caf0bbfb and 629ec78ef860. Users should apply kernel updates from their Linux distribution that include these fixes as soon as available. Systems not using MPLS functionality may reduce exposure by disabling the MPLS kernel module (CONFIG_MPLS_ROUTING). Monitor distribution-specific advisories (Red Hat, Yocto, etc.) for backported patches (Github Advisory, Red Hat Bugzilla).