Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to access small amounts of sensitive kernel memory. The issue occurs when the system notifies userspace about network mapping changes, inadvertently including uninitialized data from the kernel. While the amount of data leaked is small, it could potentially be used to bypass security protections or gain insights into kernel operations.
Technical details
An information leak exists in the build_mapping() function within net/xfrm/xfrm_user.c. The struct xfrm_usersa_id contains a one-byte padding hole after the 'proto' field that is not zero-initialized before being copied to userspace via Netlink. A local attacker with sufficient privileges to monitor XFRM netlink messages can capture this uninitialized byte, which may contain sensitive data from previous kernel operations. The vulnerability has been addressed by using memset to zero the entire structure before populating its fields.
Affected products
- Linux Linux Kernel 2.6.29.1 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-06: patched: Initial patch authored by Greg Kroah-Hartman
- 2026-05-06: disclosed: CVE-2026-43089 published
- 2026-05-06: advisory
References
- https://git.kernel.org/stable/c/1beb76b2053b68c491b78370794b8ff63c8f8c02
- https://git.kernel.org/stable/c/5a1a4b049ddde41466ccac0daeec326254b133f2
- https://git.kernel.org/stable/c/700c9622b23c33b5933e6dcea816492c064e4e10
- https://git.kernel.org/stable/c/d3125c541a96fb3c0fc7210112684baf22b6c24d
- https://git.kernel.org/stable/c/f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c