CVE-2026-43208 (GCVE-0-2026-43208)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26
VLAI
Title
net: do not pass flow_id to set_rps_cpu()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change. Compute flow_id in set_rps_cpu(), do not assume we can use the value computed by get_rps_cpu(). Otherwise we risk out-of-bound access and/or crashes.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 48aa30443e52c9666d5cd5e67532e475f212337e , < 5455a232edea6b946b99449f15ca771a8874a5a6 (git)
Affected: 48aa30443e52c9666d5cd5e67532e475f212337e , < ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c (git)
Affected: 48aa30443e52c9666d5cd5e67532e475f212337e , < 8a8a9fac9efa6423fd74938b940cb7d731780718 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5455a232edea6b946b99449f15ca771a8874a5a6",
              "status": "affected",
              "version": "48aa30443e52c9666d5cd5e67532e475f212337e",
              "versionType": "git"
            },
            {
              "lessThan": "ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c",
              "status": "affected",
              "version": "48aa30443e52c9666d5cd5e67532e475f212337e",
              "versionType": "git"
            },
            {
              "lessThan": "8a8a9fac9efa6423fd74938b940cb7d731780718",
              "status": "affected",
              "version": "48aa30443e52c9666d5cd5e67532e475f212337e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not pass flow_id to set_rps_cpu()\n\nBlamed commit made the assumption that the RPS table for each receive\nqueue would have the same size, and that it would not change.\n\nCompute flow_id in set_rps_cpu(), do not assume we can use the value\ncomputed by get_rps_cpu(). Otherwise we risk out-of-bound access\nand/or crashes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable `get_rps_cpu()`/`set_rps_cpu()` path is reached while processing received network packets through the generic RX path. In a reasonable high-performance server deployment with RFS/aRFS enabled, a remote peer can drive this path by sending traffic to an exposed service.\nAC:L - Once the affected RFS/aRFS configuration exists, exploitation does not require winning an attacker-uncontrolled race; packets and flows can be generated repeatedly to hit mismatched per-queue flow table indexes. The requirement for RFS/aRFS-capable hardware and configuration is a deployment precondition for the affected subsystem.\nPR:N - The packet-processing trigger itself requires no kernel privileges or authentication from the remote attacker. Enabling/resizing the RPS/RFS tables requires init-namespace `CAP_NET_ADMIN`, but that is administrator configuration, not attacker privilege in the scored network scenario.\nUI:N - No victim user action is required after the network service and RFS/aRFS configuration are present. The vulnerable path runs automatically during packet receive processing.\nS:U - The impact is within the Linux kernel/networking security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The stale `flow_id` can cause out-of-bounds reads from kernel `rps_dev_flow_table` memory. Because this is kernel memory corruption adjacent to attacker-influenced packet flow state, high confidentiality impact is defensible.\nI:H - The same out-of-bounds `rps_dev_flow` access can write fields such as `filter`, `hash`, `last_qtail`, and `cpu` outside the allocated table. Kernel out-of-bounds write memory corruption is scored as high integrity impact.\nA:H - The fix explicitly cites out-of-bound access and crashes, and an invalid vmalloc-backed table access can oops or panic the kernel. Repeated remote traffic can retrigger the fault on vulnerable configured systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:35.377Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5455a232edea6b946b99449f15ca771a8874a5a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a8a9fac9efa6423fd74938b940cb7d731780718"
        }
      ],
      "title": "net: do not pass flow_id to set_rps_cpu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43208",
    "datePublished": "2026-05-06T11:28:12.292Z",
    "dateReserved": "2026-05-01T14:12:55.993Z",
    "dateUpdated": "2026-08-05T12:26:35.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43208",
      "date": "2026-10-01",
      "epss": "0.00649",
      "percentile": "0.49243"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5455a232edea6b946b99449f15ca771a8874a5a6",
                    "status": "affected",
                    "version": "48aa30443e52c9666d5cd5e67532e475f212337e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c",
                    "status": "affected",
                    "version": "48aa30443e52c9666d5cd5e67532e475f212337e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a8a9fac9efa6423fd74938b940cb7d731780718",
                    "status": "affected",
                    "version": "48aa30443e52c9666d5cd5e67532e475f212337e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E0D300DB-AA68-4962-981D-EF9F5E97AACF",
                    "versionEndExcluding": "6.18.16",
                    "versionStartIncluding": "6.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                    "versionEndExcluding": "6.19.6",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not pass flow_id to set_rps_cpu()\n\nBlamed commit made the assumption that the RPS table for each receive\nqueue would have the same size, and that it would not change.\n\nCompute flow_id in set_rps_cpu(), do not assume we can use the value\ncomputed by get_rps_cpu(). Otherwise we risk out-of-bound access\nand/or crashes."
          }
        ],
        "id": "CVE-2026-43208",
        "lastModified": "2026-06-17T10:49:09.363",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-06T12:16:40.170",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5455a232edea6b946b99449f15ca771a8874a5a6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8a8a9fac9efa6423fd74938b940cb7d731780718"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:55:24+00:00",
      "cve": "CVE-2026-43208",
      "id": "CVE-2026-43208",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: do not pass flow_id to set_rps_cpu()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43208.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:21:00Z",
      "cve": "CVE-2026-43208",
      "id": "CVE-2026-43208",
      "initial_release_date": "2026-05-09T02:40:57Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43208",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43208.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.