CVE-2026-43093 (GCVE-0-2026-43093)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:25
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: tighten UMEM headroom validation to account for tailroom and min frame The current headroom validation in xdp_umem_reg() could leave us with insufficient space dedicated to even receive minimum-sized ethernet frame. Furthermore if multi-buffer would come to play then skb_shared_info stored at the end of XSK frame would be corrupted. HW typically works with 128-aligned sizes so let us provide this value as bare minimum. Multi-buffer setting is known later in the configuration process so besides accounting for 128 bytes, let us also take care of tailroom space upfront.
References
Impacted products
Vendor Product Version
Linux Linux Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
Version: ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6ee
Version: 25c9cdef57488578da21d99eb614b97ffcf6e59f
Version: 98d3c852e63b49129515dd18c875999efaf8530a
Version: 4.19.118   ≤
Version: 5.4.35   ≤
Version: 5.6.7   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f123bc278bf4e3283d8606321bebbfd299f4384",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "lessThan": "1a6051cd7e3e4c54ff3854a43b638b9292af5e67",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "lessThan": "8769708add9eadeea8041a9761771bb715a87104",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "lessThan": "a03975beb9f6af0d8ac051e30b2abeabe618414f",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "lessThan": "0ec4d3f6e6934deb843b561ae048cd17218e5ad1",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "lessThan": "9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "lessThan": "6523bc1b40e69301f24c14338b762af4739d6d39",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "lessThan": "a315e022a72d95ef5f1d4e58e903cb492b0ad931",
              "status": "affected",
              "version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6ee",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "25c9cdef57488578da21d99eb614b97ffcf6e59f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "98d3c852e63b49129515dd18c875999efaf8530a",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.118",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.35",
              "versionType": "semver"
            },
            {
              "lessThan": "5.7",
              "status": "affected",
              "version": "5.6.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: tighten UMEM headroom validation to account for tailroom and min frame\n\nThe current headroom validation in xdp_umem_reg() could leave us with\ninsufficient space dedicated to even receive minimum-sized ethernet\nframe. Furthermore if multi-buffer would come to play then\nskb_shared_info stored at the end of XSK frame would be corrupted.\n\nHW typically works with 128-aligned sizes so let us provide this value\nas bare minimum.\n\nMulti-buffer setting is known later in the configuration process so\nbesides accounting for 128 bytes, let us also take care of tailroom space\nupfront."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable UMEM headroom value is supplied through local AF_XDP socket setup via socket(), setsockopt(SOL_XDP, XDP_UMEM_REG), and bind(); network packets may later exercise the bad layout, but they do not create it.\nAC:L - The attacker controls the UMEM chunk size/headroom and AF_XDP setup parameters, and no race or rare timing condition is required.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the network namespace and related XDP/BPF setup uses namespace-capable networking privileges, which are reachable by a low-privileged local user through user namespaces in reasonable configurations.\nUI:N - No victim action is needed once the attacker can run the local setup and drive traffic through the socket.\nS:U - The impact remains within the kernel/networking security authority and does not cross a VM, IOMMU, or similar scope boundary.\nC:H - The invalid UMEM geometry can corrupt skb_shared_info/fragment metadata consumed by kernel XDP/AF_XDP paths; under the required overestimation rule, this kernel metadata corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The bug permits attacker-controlled layout overlap with kernel-used XDP fragment metadata, creating a plausible memory-corruption primitive rather than a mere validation failure.\nA:H - Malformed AF_XDP receive geometry can leave insufficient space even for minimum frames and corrupt multi-buffer metadata, making kernel/network path crashes or severe disruption plausible."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:53.221Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f123bc278bf4e3283d8606321bebbfd299f4384"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a6051cd7e3e4c54ff3854a43b638b9292af5e67"
        },
        {
          "url": "https://git.kernel.org/stable/c/8769708add9eadeea8041a9761771bb715a87104"
        },
        {
          "url": "https://git.kernel.org/stable/c/a03975beb9f6af0d8ac051e30b2abeabe618414f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ec4d3f6e6934deb843b561ae048cd17218e5ad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12"
        },
        {
          "url": "https://git.kernel.org/stable/c/6523bc1b40e69301f24c14338b762af4739d6d39"
        },
        {
          "url": "https://git.kernel.org/stable/c/a315e022a72d95ef5f1d4e58e903cb492b0ad931"
        }
      ],
      "title": "xsk: tighten UMEM headroom validation to account for tailroom and min frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43093",
    "datePublished": "2026-05-06T07:40:25.266Z",
    "dateReserved": "2026-05-01T14:12:55.984Z",
    "dateUpdated": "2026-08-05T12:25:53.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.