Junglewise Threat Intelligence

CVE-2026-43139: Linux Kernel uninitialized memory use in xfrm6_get_saddr

CVE-2026-43139 · Severity: high · CVSS 8.6 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's IPv6 networking component could allow an attacker to cause system instability or potentially access sensitive memory. The issue occurs when the system fails to find a valid source address for secure network traffic, leading it to use uninitialized data. This can result in system crashes or unpredictable behavior in environments using IPv6 and IPsec (XFRM).

Technical details

A vulnerability in net/ipv6/xfrm6_policy.c exists where xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() returns -EADDRNOTAVAIL, the saddr->in6 structure remains uninitialized. This uninitialized value is subsequently used by xfrm_tmpl_resolve_one() in xfrm_state_find(), leading to a kernel memory sanitizer (KMSAN) warning and potential undefined behavior. An attacker could potentially trigger this condition via network traffic that forces a failed source address lookup in an IPsec context. The fix involves validating the return code and propagating the error to prevent the use of uninitialized memory.

Affected products

  • Linux Linux Kernel 2.6.19 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: disclosed
  • 2026-05-06: advisory
  • 2026-02-02: patched: Initial patch committed to stable tree

References

Related threats