CVE-2026-43103: Linux Kernel lapbether Type Vulnerability

CVE-2026-43103 Overview

CVE-2026-43103 is a Linux kernel vulnerability in the LAPB over Ethernet (lapbether) driver. The flaw relates to improper handling of the NETDEV_PRE_TYPE_CHANGE netdevice notification event. The function lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER, but a type change initiated by drivers such as the bonding driver could violate this expectation. The kernel patch resolves the issue by returning NOTIFY_BAD from lapbeth_device_event() to prevent the underlying device type from being changed in a way that breaks the LAPB Ethernet driver's assumptions.

Critical Impact
An unhandled device type change beneath an active LAPB Ethernet interface could cause the kernel to operate on a device that no longer satisfies the ARPHRD_ETHER invariant, leading to undefined behavior in the network stack.

Affected Products

Linux kernel versions containing the drivers/net/wan/lapbether.c driver prior to the upstream fix
Stable kernel branches referenced in the upstream commits 328bb2cf, 363a3804, 63851f60, b1170567, and b120e443
Distributions that ship the lapbether module and have not yet incorporated the backport

Discovery Timeline

2026-05-06 - CVE-2026-43103 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43103

Vulnerability Analysis

The lapbether driver implements Link Access Procedure, Balanced (LAPB) over Ethernet. Its transmit path, lapbeth_data_transmit(), assumes the lower device is of type ARPHRD_ETHER. The Linux netdev subsystem can send a NETDEV_PRE_TYPE_CHANGE notifier to listeners before changing the hardware type of a device. This can occur, for example, when the bonding driver re-types an enslaved device.

Before the fix, lapbeth_device_event() did not actively reject this transition. If the lower device's type changed, the lapbether upper interface would continue invoking transmit logic against a device that no longer matched its assumptions. This invariant violation can produce malformed frames or trigger faults in code paths that rely on Ethernet-specific layout.

Root Cause

The root cause is missing handling of the NETDEV_PRE_TYPE_CHANGE event in the LAPB Ethernet notifier callback. The notifier did not return NOTIFY_BAD, leaving the kernel free to proceed with a device type change that the upper LAPB layer cannot tolerate. This is a kernel-level state and invariant management bug rather than a memory corruption primitive.

Attack Vector

Exploitation requires the ability to manipulate netdevice configuration on the target host, typically requiring CAP_NET_ADMIN. A local privileged user or process could, for instance, bind a lapbether instance to a device and then trigger a type change through the bonding driver. The upstream advisory does not describe a remote attack vector. The vulnerability has an EPSS probability near zero, consistent with a configuration-dependent local issue rather than a network-reachable exploit.

No public proof-of-concept code is available, and realCodeExamples were not provided. Readers seeking implementation-level detail should review the upstream commits at Kernel Git Commit Fix and Kernel Git Commit Update.

Detection Methods for CVE-2026-43103

Indicators of Compromise

Unexpected kernel warnings or oops messages referencing lapbeth_data_transmit or lapbeth_device_event in dmesg or /var/log/kern.log
Netlink events showing a hardware type change on a device that is enslaved beneath an active lapbether interface
Concurrent presence of lapbether and bonding modules with overlapping lower devices

Detection Strategies

Inventory hosts with the lapbether kernel module loaded using lsmod | grep lapbether and correlate against patch status
Audit kernel package versions against the fixed commits in the stable trees referenced by the advisory
Monitor for NETDEV_PRE_TYPE_CHANGE related notifier failures and bonding enslavement attempts on hosts running LAPB workloads

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on lapbeth driver messages
Track loaded kernel modules over time to identify hosts where lapbether is unexpectedly enabled
Alert on privileged use of ip link set type and bonding configuration changes on systems running WAN/LAPB stacks

How to Mitigate CVE-2026-43103

Immediate Actions Required

Apply the latest stable kernel update from your distribution that includes the upstream lapbether notifier fix
If patching is not immediately possible, unload the lapbether module on systems that do not require LAPB over Ethernet using modprobe -r lapbether
Restrict CAP_NET_ADMIN to trusted administrators and remove unnecessary network configuration privileges from service accounts

Patch Information

The fix is delivered through the upstream Linux kernel stable tree. Relevant commits include Kernel Git Commit Fix, Kernel Git Commit Update, Kernel Git Commit Change, Kernel Git Commit Enhancement, and Kernel Git Commit Modification. The fix modifies lapbeth_device_event() to return NOTIFY_BAD for NETDEV_PRE_TYPE_CHANGE, preventing the bonding driver and other callers from changing the underlying device type while a lapbether interface is attached.

Workarounds

Blacklist the lapbether module on hosts that do not require LAPB over Ethernet by adding blacklist lapbether to /etc/modprobe.d/
Avoid enslaving devices that sit beneath an active lapbether interface into a bonding or teaming configuration
Use kernel module signing and load policies to prevent unauthorized loading of lapbether on production systems

bash

# Configuration example: prevent loading of the lapbether module
echo 'install lapbether /bin/true' | sudo tee /etc/modprobe.d/disable-lapbether.conf
sudo modprobe -r lapbether 2>/dev/null || true
lsmod | grep lapbether