CVE-2026-43036
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-05-01
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1]. gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths. Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying. [1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407
Weakness Classification (1)
Affected Software (14)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | cbc53e08a793b073e79f42ca33f1f3568703540d < 362bacb37d88a178bfaefc4484623eae44425a70 |
| Linux | Linux | cbc53e08a793b073e79f42ca33f1f3568703540d < 5057502630fbc8ce468ff617ff59af275960b537 |
| Linux | Linux | cbc53e08a793b073e79f42ca33f1f3568703540d < f7a6cd508e9e825a2c69fa9e13d41ee156852f25 |
| Linux | Linux | cbc53e08a793b073e79f42ca33f1f3568703540d < cc91202fc20a44aab4c206f12a2bfe05da936051 |
| Linux | Linux | cbc53e08a793b073e79f42ca33f1f3568703540d < d970341cfa5594614c7a6634886c7688b4f5cafd |
| Linux | Linux | cbc53e08a793b073e79f42ca33f1f3568703540d < ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0 |
| Linux | Linux | 4.7 |
| linux | linux_kernel | 4.7 – 6.12.81 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |