CVE-2026-43107

xfrm: account XFRMA_IF_ID in aevent size calculation

State: Published
Severity: Not scored
Published: May 6, 2026
Updated: Oct 30, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: account XFRMA_IF_ID in aevent size calculation

xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then build_aevent() appends attributes including XFRMA_IF_ID when x->if_id is set.

xfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states with if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0) in xfrm_get_ae(), turning a malformed netlink interaction into a kernel panic.

Account XFRMA_IF_ID in the size calculation unconditionally and replace the BUG_ON with normal error unwinding.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7e6526404adedf079279aa7aa11722deaca8fe2e to before b7dbdc34d22f743abb2c460dfae0d69cd8a45e69Affected 7e6526404adedf079279aa7aa11722deaca8fe2e to before f8f3bb89ab677db15f9f5250c77af728f9afe995Affected 7e6526404adedf079279aa7aa11722deaca8fe2e to before 2c41283d94af943a05f7f2cc1a01f0c872f3cf43Affected 7e6526404adedf079279aa7aa11722deaca8fe2e to before e62e322ea20be78e346e4b49f9a6b9f03313af4cAffected 7e6526404adedf079279aa7aa11722deaca8fe2e to before 58e5735d1a5373652f405a0c16e54ac04aaab0adAffected 7e6526404adedf079279aa7aa11722deaca8fe2e to before 7081d46d32312f1a31f0e0e99c6835a394037599Affected
LinuxLinux	4.19Affected before 4.19Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

7e6526404adedf079279aa7aa11722deaca8fe2e to before b7dbdc34d22f743abb2c460dfae0d69cd8a45e69Affected
7e6526404adedf079279aa7aa11722deaca8fe2e to before f8f3bb89ab677db15f9f5250c77af728f9afe995Affected
7e6526404adedf079279aa7aa11722deaca8fe2e to before 2c41283d94af943a05f7f2cc1a01f0c872f3cf43Affected
7e6526404adedf079279aa7aa11722deaca8fe2e to before e62e322ea20be78e346e4b49f9a6b9f03313af4cAffected
7e6526404adedf079279aa7aa11722deaca8fe2e to before 58e5735d1a5373652f405a0c16e54ac04aaab0adAffected
7e6526404adedf079279aa7aa11722deaca8fe2e to before 7081d46d32312f1a31f0e0e99c6835a394037599Affected

LinuxLinux

4.19Affected
before 4.19Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.