CVE-2026-43373: Linux Kernel Memory Leak Vulnerability

CVE-2026-43373 Overview

CVE-2026-43373 is a memory leak vulnerability in the Linux kernel's Network Controller Sideband Interface (NCSI) subsystem. The flaw resides in early return paths within NCSI receive (RX) and Asynchronous Event Notification (AEN) handlers. These code paths fail to release the received socket buffer (skb), causing kernel memory to leak on each malformed or unresolvable NCSI packet. The issue is tracked as CWE-401: Missing Release of Memory after Effective Lifetime. Affected functions include ncsi_aen_handler(), which returns on invalid AEN packets without consuming the skb, and ncsi_rcv_rsp(), which exits early when failing to resolve the NCSI device, response handler, or request.

Critical Impact
An unauthenticated network-adjacent attacker can exhaust kernel memory on affected systems by sending crafted NCSI packets, leading to denial of service on baseboard management controller (BMC) connected hosts.

Affected Products

Linux Kernel (multiple stable branches per upstream patch series)
Linux Kernel 7.0-rc1
Linux Kernel 7.0-rc2 and 7.0-rc3

Discovery Timeline

2026-05-08 - CVE-2026-43373 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43373

Vulnerability Analysis

The vulnerability exists in the Linux kernel's NCSI protocol implementation under net/ncsi/. NCSI enables host operating systems to share a network interface with a BMC for out-of-band management. When NCSI packets arrive, the kernel allocates an skb and dispatches it to handlers such as ncsi_rcv_rsp() for command responses and ncsi_aen_handler() for asynchronous event notifications.

The defect is a classic missing free on the error path. When ncsi_aen_handler() rejects an invalid AEN packet, it returns directly without calling consume_skb() or kfree_skb(). The same pattern occurs in ncsi_rcv_rsp() when the function cannot resolve the target NCSI device, locate a response handler, or match an outstanding request. Each dropped packet permanently leaks the buffer along with its associated headroom and metadata.

Repeated triggering depletes the kernel's SLAB/SLUB allocator, ultimately producing an out-of-memory condition. The impact is availability only, consistent with the vector indicating no confidentiality or integrity compromise.

Root Cause

The root cause is improper resource management on error branches. NCSI handlers take ownership of the inbound skb but fail to release it when input validation or lookup operations fail. Because the leak occurs in normal packet-processing logic rather than a rarely exercised path, sustained malformed traffic produces continuous memory growth.

Attack Vector

NCSI traffic is typically delivered over a sideband link between the host network interface controller (NIC) and the BMC. An attacker positioned on that sideband, or able to inject NCSI frames into the host's NCSI receive path, can transmit a stream of malformed AEN packets or responses that fail device resolution. Each packet leaks one skb, allowing a low-complexity attacker without authentication to gradually exhaust kernel memory.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-43373

Indicators of Compromise

Steady, unexplained growth in Slab and SUnreclaim counters in /proc/meminfo on systems with NCSI enabled.
Kernel log entries from the ncsi subsystem reporting unresolved devices, missing response handlers, or invalid AEN packets at high frequency.
Out-of-memory (OOM) kills on BMC-attached hosts despite normal userspace memory usage.

Detection Strategies

Monitor kernel skbuff_head_cache allocations using slabtop or /proc/slabinfo and alert on sustained growth without a matching free rate.
Enable kernel memory leak detection with CONFIG_DEBUG_KMEMLEAK in lab or staging environments to surface unreleased skb allocations from net/ncsi/.
Correlate NCSI driver log messages with host memory pressure events in centralized logging.

Monitoring Recommendations

Track NCSI packet rates and error counters exposed via ethtool -S on the NCSI-bound interface.
Baseline kernel memory consumption on servers with active BMC integration and alert on deviation.
Forward kernel ring buffer messages to a SIEM and create rules for repeated ncsi_rcv_rsp or ncsi_aen_handler warnings.

How to Mitigate CVE-2026-43373

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits listed below as soon as your distribution publishes updated packages.
Inventory hosts where the NCSI subsystem is compiled in (CONFIG_NET_NCSI=y) and actively used with a BMC.
Restrict access to management network segments carrying NCSI traffic to trusted devices only.

Patch Information

The fix ensures every error path in ncsi_aen_handler() and ncsi_rcv_rsp() releases the received skb before returning. Backports are available across multiple stable branches. See the upstream commits: 553366c2, 59962588, 5c3398a5, 81d6aee3, 87138dde, 9891d7f4, b70c4e5e, and fef5aa6e.

Workarounds

If NCSI is not required, build or boot a kernel with CONFIG_NET_NCSI disabled to eliminate the vulnerable code path.
On systems that must keep NCSI enabled, isolate the BMC sideband network and block untrusted hosts from reaching it.
Schedule rolling reboots on long-running hosts showing kernel memory growth until patched kernels are deployed.

bash

# Verify whether NCSI is enabled in the running kernel
grep CONFIG_NET_NCSI /boot/config-$(uname -r)

# Check current kernel version against your distribution's patched release
uname -r

# Monitor skb-related slab usage for leak symptoms
sudo grep -E 'skbuff_head_cache|skbuff_fclone_cache' /proc/slabinfo