PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43463 Linux CVE debrief

CVE-2026-43463 is a Linux kernel vulnerability in the rxrpc/AFS path where a helper could return an error pointer, but callers only checked for NULL. The fix updates the helper to return -ENOMEM on allocation failure and changes AFS callers to use IS_ERR() and PTR_ERR(). NVD rates the issue Medium with high availability impact, consistent with a local kernel fault/denial-of-service scenario rather than a remote code execution issue.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-20
Advisory published
2026-05-08
Advisory updated
2026-05-20

Who should care

Linux kernel maintainers, distro security teams, and system administrators running affected upstream or backported kernel builds—especially systems that use AFS/RXRPC or allow untrusted local users.

Technical summary

According to the CVE description, rxrpc_kernel_lookup_peer() may return either NULL or an error pointer. The AFS call sites only checked for NULL, which means an allocation failure could be mishandled. The upstream fix does two things: it changes rxrpc_kernel_lookup_peer() to return -ENOMEM instead of NULL on allocation failure, and it updates the AFS callers to recognize and propagate error pointers with IS_ERR() and PTR_ERR(). NVD maps the weakness to CWE-476 (NULL Pointer Dereference) and lists the attack vector as local with low privileges and high availability impact.

Defensive priority

Medium — prioritize if you run affected Linux kernel versions or rely on AFS/RXRPC functionality.

Recommended defensive actions

  • Confirm whether your running kernel is within the affected upstream version ranges listed by NVD.
  • Apply the kernel updates corresponding to the referenced stable fixes from the official git.kernel.org patch links.
  • If you ship a downstream kernel, verify whether the fix has been backported into your vendor build rather than relying only on upstream version numbers.
  • Monitor systems that use AFS/RXRPC for kernel instability or unexpected service disruption after local activity.
  • Use the official CVE and NVD records to track any follow-on updates or revised affected-version guidance.

Evidence notes

Official NVD metadata for CVE-2026-43463 lists CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-476. NVD also provides vulnerable upstream version ranges: 6.7.3 through before 6.8, 6.8 through before 6.18.19, 6.19 through before 6.19.9, and 7.0-rc1 through 7.0-rc3. The supplied official references include three kernel patch links on git.kernel.org/stable.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43463 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43463

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43463 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43463

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4245a79003adf30e67f8e9060915bd05cb31d142

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/54331c5dcc6d97683d7ca2788e7ef9c9505e1477

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d55fa7cd4b19ba91b34b307d769c149e56ad0a75

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.