CVE-2026-43092 xsk: validate MTU against usable frame size on bind
Attackers can cause denial of service by configuring AF_XDP with an MTU that exceeds the usable frame size, leading to kernel instability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43092?
CVE-2026-43092 is a medium-severity denial of service vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate MTU against usable frame size on bind
AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.
This becomes a problem since we started to respect tailroom which is subtracted from chunk_size (among with headroom). 2k chunk size might not provide enough space for standard 1500 MTU, so let us catch such settings at bind time. Furthermore, validate whether underlying HW will be able to satisfy configured MTU wrt XSK's frame size multiplied by supported Rx buffer chain length (that is exposed via net_device::xdp_zc_max_segs).
Which versions are affected by CVE-2026-43092?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43092?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43092 being exploited?
There is no known exploitation of CVE-2026-43092 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43092, DEBIAN-CVE-2026-43092, GHSA-gpc7-hgpf-xq94, ROOT-OS-UBUNTU-2404-CVE-2026-43092, UBUNTU-CVE-2026-43092.