CVE-2026-43082: Linux Kernel txgbe Buffer Vulnerability

CVE-2026-43082 Overview

CVE-2026-43082 is a vulnerability in the Linux kernel's txgbe network driver. The driver allocates exactly the number of struct property_entry items it uses without leaving space for a required null terminator. Lists of struct property_entry are expected to be terminated with an empty property entry. Without that terminator, kernel code iterating the list can read beyond the allocation, leading to out-of-bounds memory access. The fix updates the struct definition to reserve an additional element for proper termination of every property_entry list.

Critical Impact
Improperly terminated property entry lists in the txgbe driver can cause out-of-bounds reads in kernel space, with potential memory disclosure or kernel instability on affected systems.

Affected Products

Linux kernel txgbe (Wangxun 10 Gigabit Ethernet) network driver
Linux kernel versions referenced in the upstream stable commits
Systems using Wangxun 10GbE NICs handled by the txgbe driver

Discovery Timeline

2026-05-06 - CVE-2026-43082 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43082

Vulnerability Analysis

The vulnerability resides in the txgbe driver in the Linux kernel networking subsystem. The driver builds a list of struct property_entry items used to describe device firmware properties. The kernel's property handling code requires these lists to end with an empty property_entry that signals the end of iteration. The txgbe driver allocated only the entries it populated, omitting the trailing sentinel. Code that walks the list to enumerate properties can therefore read past the end of the allocation. This is an out-of-bounds read condition in kernel memory [CWE-125].

The defect is a structural definition issue rather than a logic bug in property handling. Because the missing terminator is fixed at compile time by the driver's own struct layout, every code path that consumes the list is exposed. The patched code adds an extra element to the struct definition so the list is correctly terminated.

Root Cause

The root cause is an off-by-one allocation in the txgbe driver's static definition of its property_entry array. The driver sized the array to the count of populated entries, but the kernel's property iterator requires a terminating empty entry. Reads of memory adjacent to the array are then interpreted as another property_entry, producing undefined behavior.

Attack Vector

Exploitation requires the affected txgbe driver to be loaded and its property list to be enumerated. The attack vector is local to the kernel's device property processing path triggered during driver initialization or device handling. No network-facing input vector has been published. Practical impact is most consistent with kernel memory disclosure or instability rather than remote code execution.

Detailed patch information is available in the upstream commits, including Kernel Git Commit 00e1d650 and Kernel Git Commit 92c09262.

Detection Methods for CVE-2026-43082

Indicators of Compromise

Unexpected kernel warnings or KASAN out-of-bounds read reports referencing txgbe or property_entry handling
Sporadic crashes, hangs, or oops messages on systems with Wangxun 10GbE NICs during driver load
Anomalous values returned from device property lookups on txgbe-managed interfaces

Detection Strategies

Inventory hosts running kernels that include the txgbe driver and confirm whether the upstream fix commits are present
Enable KASAN (Kernel Address Sanitizer) in test environments to detect out-of-bounds reads in driver initialization paths
Compare installed kernel package versions against distribution advisories that incorporate the listed stable commits

Monitoring Recommendations

Centralize dmesg and journalctl -k output and alert on kernel WARN, BUG, or KASAN entries naming txgbe
Track kernel package versions across the fleet and flag systems still running pre-patch builds
Monitor NIC driver load events on hosts with Wangxun 10GbE adapters for repeated initialization failures

How to Mitigate CVE-2026-43082

Immediate Actions Required

Apply the kernel update from your Linux distribution that includes the upstream txgbeproperty_entry fix
On systems where Wangxun 10GbE hardware is not present, blacklist the txgbe module to remove the affected code path
Reboot systems after applying the updated kernel so the patched driver is loaded

Patch Information

The fix is published in the Linux kernel stable tree across multiple branches. Reference commits include 00e1d650fa4b, 16eb3c2f86de, 5a37d228799b, 8eff73e58e1f, and 92c09262dac5. Distribution kernels backporting these commits resolve the issue.

Workarounds

Unload and blacklist the txgbe module on hosts that do not require Wangxun 10GbE connectivity
Restrict physical and administrative access to systems running unpatched kernels with the driver loaded
Schedule kernel updates through standard change-control processes if immediate patching is not feasible

bash

# Example: blacklist the txgbe driver until a patched kernel is deployed
echo "blacklist txgbe" | sudo tee /etc/modprobe.d/blacklist-txgbe.conf
sudo update-initramfs -u
sudo reboot