CVE-2026-43139: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43139 Overview

CVE-2026-43139 is an uninitialized memory use vulnerability in the Linux kernel's IPv6 IPsec transform (xfrm6) subsystem. The flaw resides in xfrm6_get_saddr(), which fails to check the return value of ipv6_dev_get_saddr(). When source address resolution fails with -EADDRNOTAVAIL, the saddr->in6 structure remains uninitialized while the function still returns success. The caller xfrm_tmpl_resolve_one() then passes this stack-allocated garbage to xfrm_state_find(), producing the KMSAN warning documented in the upstream report. The defect affects IPsec policy lookup paths exercised during IPv6 socket transmission, including UDP sendmsg() flows.

Critical Impact
Local code paths invoking IPv6 IPsec lookups can read uninitialized stack memory, potentially affecting IPsec state matching and exposing kernel stack contents to subsequent processing.

Affected Products

Linux kernel — IPv6 xfrm (IPsec transform) subsystem
Stable branches receiving the backported fixes referenced in the kernel.org advisory
Distributions shipping affected upstream kernels prior to the patch commits

Discovery Timeline

2026-05-06 - CVE-2026-43139 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43139

Vulnerability Analysis

The vulnerability is a classic uninitialized memory use defect [CWE-908] in the kernel networking stack. xfrm6_get_saddr() is responsible for selecting an IPv6 source address when constructing an IPsec transform bundle. It delegates source address selection to ipv6_dev_get_saddr(), writing the result into a local xfrm_address_t structure. The function ignores the helper's return code and unconditionally returns 0, signalling success to its caller. KMSAN (the Kernel Memory Sanitizer) detected the resulting taint propagating into xfrm_state_find() during a udp_sendmsg() syscall path. The EPSS score for this issue is 0.024%, reflecting a low likelihood of opportunistic exploitation.

Root Cause

The root cause is missing error handling. ipv6_dev_get_saddr() can return -EADDRNOTAVAIL when no suitable source address exists for the destination scope. Because xfrm6_get_saddr() does not propagate this error, callers treat the uninitialized saddr->in6 field as a valid address. The fix, applied across multiple stable branches, checks the helper's return value and propagates the error upward so xfrm_tmpl_resolve_one() aborts cleanly.

Attack Vector

The attack surface is reachable from any local context that triggers IPv6 IPsec policy resolution, such as sending UDP traffic when an xfrm policy is installed but no usable source address is configured. A local user able to send IPv6 packets through an interface lacking an appropriate source address can deterministically reach the vulnerable code path. The consumed uninitialized data flows into IPsec state lookup, where it can affect security association matching. Refer to the upstream commits referenced under Linux Kernel Commit 1799d8a and Linux Kernel Commit 4f28141 for the precise diff.

Detection Methods for CVE-2026-43139

Indicators of Compromise

KMSAN uninit-value reports in kernel logs referencing xfrm_state_find and xfrm_resolve_and_create_bundle call frames.
Unexpected IPsec state lookup behavior on hosts where IPv6 source address selection fails with EADDRNOTAVAIL.
Kernel oops, WARN, or sporadic IPsec policy mismatches on IPv6 interfaces lacking a global scope source address.

Detection Strategies

Inventory kernel versions across Linux endpoints and servers and compare against the fixed commits listed on git.kernel.org.
Run KMSAN- or KASAN-enabled debug kernels in pre-production to surface latent uninitialized-use reports in the xfrm path.
Monitor dmesg and journald for warnings emitted by the xfrm subsystem during IPsec session establishment.

Monitoring Recommendations

Centralize kernel logs in a SIEM or data lake and alert on KMSAN, KASAN, or xfrm_state_find stack traces.
Track IPsec policy and SA counters via ip xfrm monitor to detect anomalous resolution failures.
Enable kernel package auditing so changes to kernel-core and linux-image-* versions are recorded for incident response.

How to Mitigate CVE-2026-43139

Immediate Actions Required

Apply the upstream patch commits — 1799d8a, 3dcd166, 4f28141, 6535867, 719918f, c7221e7, dc0abce, and eb2ee15 — by upgrading to a kernel that includes them.
Prioritize hosts running IPv6 IPsec, including VPN concentrators, route reflectors, and IPsec-enabled application servers.
Reboot patched systems to load the fixed kernel image, since live xfrm code paths cannot be hot-replaced without livepatch coverage.

Patch Information

The Linux kernel maintainers fixed the issue by checking the return value of ipv6_dev_get_saddr() inside xfrm6_get_saddr() and propagating -EADDRNOTAVAIL to callers. The change is available across multiple stable branches; consult Linux Kernel Commit eb2ee15 and Linux Kernel Commit 6535867 for the backports applicable to your branch. Distribution vendors are expected to ship updated linux-image packages as part of routine kernel security advisories.

Workarounds

Ensure every IPv6-enabled interface that participates in IPsec has a usable source address in the appropriate scope, reducing the chance that ipv6_dev_get_saddr() returns EADDRNOTAVAIL.
Restrict local user access on hosts running unpatched kernels with IPv6 IPsec enabled until updates can be deployed.
Where IPsec over IPv6 is not required, consider disabling the relevant xfrm policies or the IPv6 stack on isolated workloads as a temporary measure.

bash

# Identify running kernel and verify it includes the xfrm6_get_saddr fix
uname -r
rpm -q --changelog kernel-core | grep -i xfrm6_get_saddr   # RHEL/Fedora
apt changelog linux-image-$(uname -r) | grep -i xfrm6_get_saddr  # Debian/Ubuntu

# Inspect IPv6 source address availability per interface
ip -6 addr show

# Watch for xfrm-related kernel warnings
dmesg -T --level=warn,err | grep -Ei 'xfrm|KMSAN'