CVE-2026-43092 Details
Description
In the Linux kernel, the following vulnerability has been resolved: xsk: validate MTU against usable frame size on bind AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk. This becomes a problem since we started to respect tailroom which is subtracted from chunk_size (among with headroom). 2k chunk size might not provide enough space for standard 1500 MTU, so let us catch such settings at bind time. Furthermore, validate whether underlying HW will be able to satisfy configured MTU wrt XSK's frame size multiplied by supported Rx buffer chain length (that is exposed via net_device::xdp_zc_max_segs).
A vulnerability in the Linux kernel's AF_XDP bind process allows zero-copy pool configurations without proper validation of the device's Maximum Transmission Unit (MTU) against the usable frame size provided by the User Memory (UMEM) chunk. This issue arises because the kernel now accounts for tailroom, which reduces the effective chunk size, potentially leaving insufficient space for a standard 1500 MTU. The vulnerability affects several versions of the Linux kernel.
Users should ensure that the chunk size in zero-copy pool configurations allows for the full MTU size, including any additional space required for Ethernet padding. This can be done by adjusting the chunk size to accommodate the MTU plus the Ethernet padding length.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/25e1e91a8da819924df0b16e3812d7b24c8ce133 | kernel.org | Patch |
| https://git.kernel.org/stable/c/36ee60b569ba0dfb6f961333b90d19ab5b323fa9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a55793e5a97d4e39bdb380873a9780fe0010bff6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b2f4daa6422fd6cc0cec969794dab4a88ea4cea1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f669d60db11dbabb96279f2b20f9d1cba43cddb2 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.6, < 6.6.136 >= 6.7, < 6.12.83 >= 6.13, < 6.18.24 >= 6.19, < 6.19.14 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 7.0 rc7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | New CVE Received | kernel.org |