# CVE-2026-43035: Linux kernel information leak in tc_chain_fill_node

Source: https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-43035 · Severity: medium · CVSS 5.5 · Published 2026-05-01

A vulnerability in the Linux kernel's networking subsystem could allow a local user to access sensitive information from the system's memory. This occurs because certain internal messages were not properly cleared before being sent to user-accessible areas. While this specific flaw primarily impacts system privacy, it could potentially be used to facilitate more complex attacks against the operating system or affected industrial hardware.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp), [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-43035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43035 being exploited in the wild.

**How severe is CVE-2026-43035?** Medium severity, with a CVSS score of 5.5, published 1 May 2026.

**Which products and versions are affected?** Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.

**Is there a fix for CVE-2026-43035?** A patch was published on 2026-04-11: Patches committed to stable kernel trees Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43035 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-43035?** Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information leak vulnerability exists in the Linux kernel's net/sched/cls_api.c component due to an uninitialized resource (CWE-908). The function tc_chain_fill_node() fails to initialize the tcm_info field of the tcmsg structure. Because the underlying memory allocation is not zeroed, 4 bytes of kernel heap memory are leaked to userspace when netlink messages are constructed. A local attacker with basic privileges can exploit this to read sensitive kernel memory. The issue has been resolved in multiple stable kernel branches by explicitly zeroing the tcm_info field.

## Affected products

- Linux Linux Kernel
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

## Timeline

- 2026-03-29: disclosed: Initial patch authored by Yochai Eisenrich
- 2026-04-11: patched: Patches committed to stable kernel trees
- 2026-05-01: advisory: CVE published to NVD
- 2026-07-14: advisory: Siemens updated advisory with affected industrial products

## References

- [https://git.kernel.org/stable/c/1091b3c174441a52fdbb92e2fe00338f9371a91c](https://git.kernel.org/stable/c/1091b3c174441a52fdbb92e2fe00338f9371a91c)
- [https://git.kernel.org/stable/c/4ae5d23f51fb91d7d1140c6f1ba77ab0756054c3](https://git.kernel.org/stable/c/4ae5d23f51fb91d7d1140c6f1ba77ab0756054c3)
- [https://git.kernel.org/stable/c/71a3eda7e850ae844cb8993065f4e410c11a46ce](https://git.kernel.org/stable/c/71a3eda7e850ae844cb8993065f4e410c11a46ce)
- [https://git.kernel.org/stable/c/903c3405cfcc7700260e456ab66a5867586c9e69](https://git.kernel.org/stable/c/903c3405cfcc7700260e456ab66a5867586c9e69)
- [https://git.kernel.org/stable/c/906997ea3766c24fbbf9cc4bf17c047315bbd138](https://git.kernel.org/stable/c/906997ea3766c24fbbf9cc4bf17c047315bbd138)
- [https://git.kernel.org/stable/c/d6db08484c6cb3d4ad696246f9d288eceba2a078](https://git.kernel.org/stable/c/d6db08484c6cb3d4ad696246f9d288eceba2a078)
- [https://git.kernel.org/stable/c/e35f5195cd44ff4053fbc5d71ea97681728a0099](https://git.kernel.org/stable/c/e35f5195cd44ff4053fbc5d71ea97681728a0099)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)