CVE-2026-43089 xfrm_user: fix info leak in build_mapping()
A padding hole in the Linux kernel's xfrm_user module allows local attackers to read uninitialized kernel memory, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43089?
CVE-2026-43089 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm_user: fix info leak in build_mapping()
struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. Fix that up by zeroing out the whole structure before setting individual variables.
Weakness: CWE-401
Which versions are affected by CVE-2026-43089?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43089?
Apply the vendor's patch.
Is CVE-2026-43089 being exploited?
There is no known exploitation of CVE-2026-43089 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43089, DEBIAN-CVE-2026-43089, GHSA-8xhw-c2pc-2vqq, ROOT-OS-DEBIAN-11-CVE-2026-43089, ROOT-OS-DEBIAN-12-CVE-2026-43089, ROOT-OS-UBUNTU-2204-CVE-2026-43089 and 2 more.