CVE-2026-43107: Linux Kernel XFRM DoS Vulnerability

CVE-2026-43107 Overview

CVE-2026-43107 is a Linux kernel vulnerability in the IPsec transformation (xfrm) subsystem. The flaw resides in xfrm_get_ae(), which allocates a reply socket buffer using xfrm_aevent_msgsize() before build_aevent() appends netlink attributes. The size calculation omits space for the XFRMA_IF_ID attribute, which build_aevent() adds when x->if_id is set. When the buffer overflows during attribute append, the function returns -EMSGSIZE and trips a BUG_ON(err < 0) check, converting a malformed netlink interaction into a kernel panic.

Critical Impact
A local actor with the ability to issue netlink requests against XFRM states configured with an if_id can trigger a kernel panic, resulting in denial of service on affected Linux hosts.

Affected Products

Linux kernel versions containing the xfrm_aevent_msgsize() size calculation without XFRMA_IF_ID accounting
Distributions shipping the affected stable kernel branches referenced in the upstream commits
Systems using IPsec XFRM states with if_id set (commonly with XFRM interfaces / route-based VPNs)

Discovery Timeline

2026-05-06 - CVE-2026-43107 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43107

Vulnerability Analysis

The defect is a kernel-side input validation and resource sizing error in the XFRM netlink interface. xfrm_get_ae() services XFRM_MSG_GETAE netlink requests by preallocating a reply skb sized via xfrm_aevent_msgsize(). That helper enumerates expected attributes such as replay state, lifetime, and mark, but it does not include nla_total_size(sizeof(__u32)) for the XFRMA_IF_ID attribute.

build_aevent() later appends XFRMA_IF_ID whenever the XFRM state carries a non-zero if_id. Because the skb was undersized, the append fails with -EMSGSIZE. The caller then hits BUG_ON(err < 0), which triggers an oops and panics the kernel on configurations where panic_on_oops is set or where the BUG occurs in a non-recoverable context.

This class of issue maps to improper resource sizing leading to a denial-of-service kernel panic, rather than memory corruption. No memory disclosure or privilege escalation primitives are described in the upstream fix.

Root Cause

The root cause is a missing accounting term in xfrm_aevent_msgsize(). The function must reserve attribute space symmetric to what build_aevent() may emit. By not including XFRMA_IF_ID, the allocated skb cannot accommodate the full attribute set for states using XFRM interfaces. The secondary defect is the use of BUG_ON(err < 0) for a recoverable condition, which escalates a netlink build failure into a panic instead of returning the error to userspace.

Attack Vector

Triggering the bug requires the ability to query XFRM async events for a state that has if_id set. An actor with CAP_NET_ADMIN in the relevant network namespace, or a misbehaving management daemon, can request the aevent for such a state and reach the BUG_ON. The fix accounts for XFRMA_IF_ID unconditionally in the size calculation and replaces BUG_ON with normal error unwinding so that future sizing mismatches surface as -EMSGSIZE to the caller.

No public exploit is associated with CVE-2026-43107, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.018%.

Detection Methods for CVE-2026-43107

Indicators of Compromise

Kernel oops or panic messages referencing xfrm_get_ae, build_aevent, or xfrm_aevent_msgsize in dmesg or /var/log/kern.log.
Unexpected host reboots correlated with IPsec management activity or XFRM netlink queries.
Repeated XFRM_MSG_GETAE netlink requests targeting states configured with an XFRM if_id.

Detection Strategies

Audit running kernel versions against the fixed commits 2c41283d94af, 58e5735d1a53, 7081d46d3231, and e62e322ea20b to identify unpatched hosts.
Correlate kernel crash telemetry with processes invoking NETLINK_XFRM sockets, particularly VPN orchestrators and routing daemons.
Inspect XFRM state dumps for entries with non-zero if_id to scope which hosts are exposure-relevant.

Monitoring Recommendations

Forward kernel.* syslog facility messages to a central log store and alert on panic and oops signatures.
Monitor host availability and unplanned reboots on systems running IPsec gateways, route-based VPNs, or XFRM interface configurations.
Track usage of CAP_NET_ADMIN and netlink XFRM operations to detect abnormal query patterns.

How to Mitigate CVE-2026-43107

Immediate Actions Required

Apply the upstream stable kernel updates that include the xfrm: account XFRMA_IF_ID in aevent size calculation fix from your distribution.
Restrict CAP_NET_ADMIN and access to NETLINK_XFRM sockets to trusted management components and namespaces.
Reboot patched systems to ensure the fixed kernel is active, since the defect is in resident kernel code.

Patch Information

The issue is resolved in the mainline and stable Linux kernel trees by accounting for XFRMA_IF_ID in xfrm_aevent_msgsize() and replacing the BUG_ON(err < 0) with normal error unwinding. Reference the upstream commits: Kernel commit 2c41283d94af, Kernel commit 58e5735d1a53, Kernel commit 7081d46d3231, and Kernel commit e62e322ea20b.

Workarounds

Avoid configuring XFRM states with a non-zero if_id until kernels are patched, where operationally feasible.
Set kernel.panic_on_oops=0 to reduce the chance that a triggered BUG_ON cascades into a full panic, while accepting that the kernel will still log an oops.
Limit which workloads and containers receive CAP_NET_ADMIN so untrusted code cannot reach the vulnerable netlink path.

bash

# Verify running kernel version and check for the fix
uname -r

# Apply distribution kernel updates (examples)
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/-generic//')

# RHEL/Rocky/Alma
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot