PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43092 Linux CVE debrief

A validation flaw in the Linux kernel's AF_XDP socket bind operation allows zero-copy pool configurations that do not accommodate the device MTU within the usable frame space. When tailroom is subtracted from chunk_size, a 2KB chunk may be insufficient for standard 1500-byte MTU frames. The kernel now validates at bind time that the MTU fits within the frame size and that underlying hardware can satisfy the configured MTU with respect to XSK's frame size multiplied by the supported Rx buffer chain length (net_device::xdp_zc_max_segs). This is a local denial-of-service condition requiring privileges to configure AF_XDP sockets.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-06
Original CVE updated
2026-05-19
Advisory published
2026-05-06
Advisory updated
2026-05-19

Who should care

Linux system administrators operating high-performance networking with AF_XDP zero-copy sockets; kernel maintainers; network stack developers; security teams monitoring local privilege-required DoS vectors in kernel networking subsystems

Technical summary

The AF_XDP (Address Family eXpress Data Path) socket implementation in the Linux kernel did not validate that the network device MTU would fit within the usable frame space of a zero-copy UMEM pool at bind time. With the introduction of tailroom accounting, a 2KB chunk size may not provide sufficient space for standard 1500-byte MTU frames after headroom and tailroom deductions. The fix adds validation at bind time to ensure the MTU fits within the usable frame size and that hardware can satisfy the MTU given XSK's frame size and the supported Rx buffer chain length (xdp_zc_max_segs). This prevents misconfigurations that could lead to packet handling failures. The vulnerability is local, requires privileges to configure AF_XDP sockets, and results in availability impact only.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches (6.6.136+, 6.12.83+, 6.18.24+, 6.19.14+, or 7.0-rc8+) to ensure AF_XDP bind validates MTU against frame size
  • Review AF_XDP socket configurations for MTU/frame size mismatches on systems using zero-copy pools
  • Monitor kernel logs for bind-time validation failures after patching
  • Validate UMEM chunk sizes account for headroom, tailroom, and MTU requirements in zero-copy deployments

Evidence notes

CVE published 2026-05-06; modified 2026-05-19. Patches available for stable kernel branches 6.6, 6.12, 6.18, 6.19, and 7.0-rc series. CVSS 5.5 (MEDIUM) per NVD. CPE ranges indicate affected versions from 6.6 through 6.6.135, 6.7 through 6.12.82, 6.13 through 6.18.23, 6.19 through 6.19.13, and 7.0-rc1 through rc7.

Official resources

2026-05-06