CVE-2026-43463 Linux CVE debrief

Who should care

Linux kernel maintainers, distro security teams, and system administrators running affected upstream or backported kernel builds—especially systems that use AFS/RXRPC or allow untrusted local users.

Technical summary

According to the CVE description, rxrpc_kernel_lookup_peer() may return either NULL or an error pointer. The AFS call sites only checked for NULL, which means an allocation failure could be mishandled. The upstream fix does two things: it changes rxrpc_kernel_lookup_peer() to return -ENOMEM instead of NULL on allocation failure, and it updates the AFS callers to recognize and propagate error pointers with IS_ERR() and PTR_ERR(). NVD maps the weakness to CWE-476 (NULL Pointer Dereference) and lists the attack vector as local with low privileges and high availability impact.

Defensive priority

Medium — prioritize if you run affected Linux kernel versions or rely on AFS/RXRPC functionality.

Recommended defensive actions

• Confirm whether your running kernel is within the affected upstream version ranges listed by NVD.
• Apply the kernel updates corresponding to the referenced stable fixes from the official git.kernel.org patch links.
• If you ship a downstream kernel, verify whether the fix has been backported into your vendor build rather than relying only on upstream version numbers.
• Monitor systems that use AFS/RXRPC for kernel instability or unexpected service disruption after local activity.
• Use the official CVE and NVD records to track any follow-on updates or revised affected-version guidance.

Evidence notes

Official NVD metadata for CVE-2026-43463 lists CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-476. NVD also provides vulnerable upstream version ranges: 6.7.3 through before 6.8, 6.8 through before 6.18.19, 6.19 through before 6.19.9, and 7.0-rc1 through 7.0-rc3. The supplied official references include three kernel patch links on git.kernel.org/stable.

Official resources