CVE-2026-43036 net: use skb_header_pointer() for TCPv4 GSO frag_off check
A Linux kernel vulnerability allows reading uninitialized memory during TCPv4 GSO checks, potentially disclosing sensitive kernel data to local attackers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43036?
CVE-2026-43036 is a medium-severity vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: use skb_header_pointer() for TCPv4 GSO frag_off check
Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1].
gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths.
Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying.
[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407
Weakness: CWE-908
Which versions are affected by CVE-2026-43036?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43036?
Apply the vendor's patch.
Is CVE-2026-43036 being exploited?
There is no known exploitation of CVE-2026-43036 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-85359, BELL-CVE-2026-43036, DEBIAN-CVE-2026-43036, GHSA-wjhp-5p5w-qmhh, ROOT-OS-DEBIAN-11-CVE-2026-43036, ROOT-OS-DEBIAN-12-CVE-2026-43036 and 3 more.