CVE-2026-43373 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: ncsi: fix skb leak in error paths Early return paths in NCSI RX and AEN handlers fail to release the received skb, resulting in a memory leak. Specifically, ncsi_aen_handler() returns on invalid AEN packets without consuming the skb. Similarly, ncsi_rcv_rsp() exits early when failing to resolve the NCSI device, response handler, or request, leaving the skb unfreed.
A memory leak vulnerability has been identified in the Linux kernel's Network Controller Sideband Interface (NCSI) component. This issue arises because the NCSI AEN (Asynchronous Event Notification) and response handlers do not properly release the received socket buffers (skbs) in certain error scenarios. Specifically, the AEN handler returns early on invalid packets without freeing the skb, and the response handler fails to release the skb when it cannot resolve the NCSI device or related requests.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the updated kernel can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/553366c271479c0d571dd1bb5d1bcde4747fb82e | kernel.org | Patch |
| https://git.kernel.org/stable/c/59962588197863d0d746879f193905c0c6b3df49 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5c3398a54266541610c8d0a7082e654e9ff3e259 | kernel.org | Patch |
| https://git.kernel.org/stable/c/81d6aee32f8f7bbc175c05dbf61f4430bfb88c4a | kernel.org | Patch |
| https://git.kernel.org/stable/c/87138dde2d6937b12b967f28fe598a7d59000ae4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9891d7f4f1ede473c54b49776ae07755083eef06 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b70c4e5e711931cdd56e6e905737b72f1e649189 | kernel.org | Patch |
| https://git.kernel.org/stable/c/fef5aa6e3bcf3c8053307642663a63b7362d7552 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.8, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.167 >= 6.2, < 6.6.130 >= 6.7, < 6.12.78 >= 6.13, < 6.18.19 >= 6.19, < 6.19.9 7.0 rc1 7.0 rc2 7.0 rc3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | New CVE Received | kernel.org |