CVE-2026-43244 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators running systems with KCM enabled, especially where local users can reach the affected socket path.

Technical summary

According to the source description, kcm_sendmsg() may allocate and link a new skb into frag_list after filling MAX_SKB_FRAGS in the current skb. If the subsequent user-copy fails, the new tail skb can remain with zero fragments. For SOCK_SEQPACKET, a later zero-length write can complete the partial message and queue it, and kcm_write_msgs() then encounters a zero-fragment skb and reaches WARN_ON(!skb_shinfo(skb)->nr_frags). The fix tracks the predecessor skb so the empty tail can be unlinked and freed on error, and changes the warning to WARN_ON_ONCE. The NVD record lists CWE-401 and a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

Medium. The issue is local and availability-focused, but it can lead to kernel warnings and service disruption on affected kernels.

Recommended defensive actions

• Apply the Linux kernel fixes referenced in the NVD record and vendor patch links.
• Verify whether KCM is enabled or used in your kernel builds and deployments.
• Prioritize updates for systems that expose local login access or run multi-tenant workloads.
• Monitor affected hosts for repeated kernel warnings involving kcm_write_msgs() or frag_list handling.
• Use the published version ranges to confirm exposure across your kernel fleet: 4.6 through 6.12.75, 6.13 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1.

Evidence notes

Evidence comes from the supplied NVD record and its linked stable.kernel.org patches. The source description explains the failure mode: an empty skb can remain in frag_list after a partial sendmsg() error, leading kcm_write_msgs() to hit a warning. NVD marks the vulnerability as analyzed, assigns CWE-401, and provides the affected version ranges and CVSS vector. The source also notes that there are currently no KCM selftests in the kernel tree.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.