CVE-2026-43373 Git CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems that use NCSI-capable network paths should care most. Systems exposed to untrusted or malformed network traffic are the primary concern because the flaw sits in receive/error handling.

Technical summary

The vulnerability affects NCSI RX and AEN handling. In ncsi_aen_handler(), invalid AEN packets can cause an early return without consuming the skb. In ncsi_rcv_rsp(), early exits while failing to resolve the NCSI device, response handler, or request leave the skb unfreed. Repeated occurrences can leak kernel memory over time.

Defensive priority

High. The issue is network reachable, requires no privileges or user interaction, and impacts availability only, which makes it a practical denial-of-service concern for exposed systems.

Recommended defensive actions

• Apply the Linux kernel fixes associated with the referenced stable commits as soon as practical.
• Prioritize updates on hosts that use NCSI or have network management paths exposed in production.
• Watch for abnormal kernel memory growth or instability on affected systems until patched.
• Use vendor kernel advisories and stable backports to confirm which released kernel versions include the fix.
• Treat malformed or unexpected NCSI traffic as a possible trigger path when assessing exposure.

Evidence notes

The CVE description states that early return paths in ncsi_aen_handler() and ncsi_rcv_rsp() fail to release received skb buffers. The supplied NVD record gives CVSS v3.1 7.5 HIGH with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and its references point to Linux kernel stable commit URLs, indicating upstream/backport fix material. Timing in this debrief uses the supplied CVE published and modified timestamps only.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.