CVE-2026-43244: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43244 Overview

CVE-2026-43244 is a Linux kernel vulnerability in the Kernel Connection Multiplexor (KCM) subsystem. The flaw triggers a WARN_ON in kcm_write_msgs() when processing a message containing a zero-fragment socket buffer (skb) within the frag_list. Syzkaller discovered the issue while fuzzing the KCM sendmsg path with partial copy failures from user memory.

The defect arises during error handling in kcm_sendmsg() after MAX_SKB_FRAGS is reached and a new tail skb (tskb) is linked into frag_list before data copy. When the copy fails with -EFAULT, the empty skb remains attached and is later processed when the message is queued to sk_write_queue.

Critical Impact
A local user with KCM socket access can trigger a kernel warning and potential denial-of-service condition by inducing a partial sendmsg failure on a SOCK_SEQPACKET KCM socket.

Affected Products

Linux kernel — KCM (Kernel Connection Multiplexor) subsystem
Stable kernel branches receiving fixes via commits 7af58f76, 9ea3671d, b1e3edf6, and ca220141
Distributions shipping vulnerable Linux kernels with KCM enabled (CONFIG_AF_KCM)

Discovery Timeline

2026-05-06 - CVE-2026-43244 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43244

Vulnerability Analysis

The vulnerability resides in the KCM sendmsg write path. When kcm_sendmsg() fills the current skb's frags[] array up to MAX_SKB_FRAGS, it allocates an additional skb (tskb) and links it into the head skb's frag_list before copying user data. If the user-memory copy then fails, tskb is left attached to frag_list with nr_frags == 0.

For SOCK_SEQPACKET sockets, the partially assembled message is preserved via partial_message for later completion. Because sock_write_iter() automatically sets MSG_EOR on SOCK_SEQPACKET, a subsequent zero-length write(fd, NULL, 0) finalizes the message and queues it onto sk_write_queue. The transmit path kcm_write_msgs() then walks frag_list and triggers WARN_ON(!skb_shinfo(skb)->nr_frags).

TCP avoids this class of bug through tcp_remove_empty_skb(), which cleans up empty skbs after a copy failure. KCM lacked the equivalent cleanup, allowing a malformed skb chain to reach the send path.

Root Cause

The root cause is missing error-path cleanup of empty skbs linked into frag_list before user data is copied. The KCM send path treats skb allocation and data copy as separate steps without unwinding the linkage when the copy fails. This is a kernel input validation and resource cleanup defect in the network protocol code.

Attack Vector

A local unprivileged user with the ability to open a KCM SOCK_SEQPACKET socket can trigger the warning. The attacker calls sendmsg() with a payload large enough to fill MAX_SKB_FRAGS, then induces a copy failure by passing a user buffer that becomes invalid mid-copy (for example, by munmap-ing a page). A subsequent zero-length write completes the partial message and triggers the warning during transmission. A reproducer was published in the upstream commit message.

The vulnerability mechanism is described in the upstream Kernel Git Commit b1e3edf6 and parallel stable-tree backports.

Detection Methods for CVE-2026-43244

Indicators of Compromise

Kernel log entries containing WARN_ON or WARN_ON_ONCE originating from kcm_write_msgs in net/kcm/kcmsock.c.
Stack traces in dmesg referencing kcm_sendmsg, kcm_write_msgs, and skb_shinfo together.
Unexpected use of the AF_KCM socket family by non-administrative processes.

Detection Strategies

Monitor kernel ring buffer and journalctl -k output for repeated kcm_write_msgs warnings, which indicate trigger attempts.
Audit socket(AF_KCM, SOCK_SEQPACKET, ...) system calls via auditd or eBPF tracing to identify processes exercising KCM.
Correlate EFAULT returns from sendmsg() on KCM file descriptors with subsequent zero-length writes from the same process.

Monitoring Recommendations

Forward kernel logs to a centralized log pipeline and alert on WARN_ON_ONCE events from networking subsystems.
Track loaded kernel modules and confirm whether kcm is present on hosts that do not require it.
Baseline KCM socket usage per host and flag deviations, since legitimate KCM consumers are uncommon.

How to Mitigate CVE-2026-43244

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 7af58f76, 9ea3671d, b1e3edf6, and ca220141 as soon as distribution updates are available.
Disable or blacklist the kcm kernel module on systems that do not require Kernel Connection Multiplexor functionality.
Restrict access to the AF_KCM socket family using seccomp profiles or SELinux/AppArmor policies for untrusted workloads.

Patch Information

The fix tracks the predecessor skb (frag_prev) when allocating a new frag_list entry. On error, if the tail skb has zero frags, frag_prev is used to unlink and free it in O(1) without walking the singly linked frag_list. The patch also downgrades WARN_ON to WARN_ON_ONCE to prevent log flooding. Patches are available in Kernel Git Commit 7af58f76, Kernel Git Commit 9ea3671d, Kernel Git Commit b1e3edf6, and Kernel Git Commit ca220141.

Workarounds

Prevent the kcm module from loading by adding install kcm /bin/true to a file under /etc/modprobe.d/.
Apply seccomp filters to block socket() calls with domain == AF_KCM for untrusted processes and containers.
Limit container and namespace creation privileges so unprivileged users cannot open KCM sockets in isolated network namespaces.

bash

# Configuration example
# Disable the KCM kernel module on hosts that do not require it
echo 'install kcm /bin/true' | sudo tee /etc/modprobe.d/blacklist-kcm.conf
sudo rmmod kcm 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -i kcm