CVE-2026-43093xsk: tighten UMEM headroom validation to account for tailroom and min frame
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xsk: tighten UMEM headroom validation to account for tailroom and min frame The current headroom validation in xdp_umem_reg() could leave us with insufficient space dedicated to even receive minimum-sized ethernet frame. Furthermore if multi-buffer would come to play then skb_shared_info stored at the end of XSK frame would be corrupted. HW typically works with 128-aligned sizes so let us provide this value as bare minimum. Multi-buffer setting is known later in the configuration process so besides accounting for 128 bytes, let us also take care of tailroom space upfront.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 builds before 5f123bc278bf4e3283d8606321bebbfd299f4384; 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 builds before 1a6051cd7e3e4c54ff3854a43b638b9292af5e67; from 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 before 8769708add9eadeea8041a9761771bb715a87104; from 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 before a03975beb9f6af0d8ac051e30b2abeabe618414f; 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 builds before 0ec4d3f6e6934deb843b561ae048cd17218e5ad1; 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 builds before 9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12; from 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 before 6523bc1b40e69301f24c14338b762af4739d6d39; from 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 before a315e022a72d95ef5f1d4e58e903cb492b0ad931; and 6 more ranges | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.19.118 before 4.20; from 5.4.35 before 5.5; from 5.6.7 before 5.7; from 5.7.1 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 5.7; and 13 more ranges | NVD |
References
- https://git.kernel.org/stable/c/5f123bc278bf4e3283d8606321bebbfd299f4384
- https://git.kernel.org/stable/c/1a6051cd7e3e4c54ff3854a43b638b9292af5e67
- https://git.kernel.org/stable/c/8769708add9eadeea8041a9761771bb715a87104
- https://git.kernel.org/stable/c/a03975beb9f6af0d8ac051e30b2abeabe618414fpatch
- https://git.kernel.org/stable/c/0ec4d3f6e6934deb843b561ae048cd17218e5ad1patch
- https://git.kernel.org/stable/c/9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12patch
- https://git.kernel.org/stable/c/6523bc1b40e69301f24c14338b762af4739d6d39patch
- https://git.kernel.org/stable/c/a315e022a72d95ef5f1d4e58e903cb492b0ad931patch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.