CVE-2026-43109 x86: shadow stacks: proper error handling for mmap lock
Missing error handling in Linux kernel shadow stack code can lead to null pointer dereference and system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43109?
CVE-2026-43109 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86: shadow stacks: proper error handling for mmap lock
김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it.
So let's fix both issues.
Which versions are affected by CVE-2026-43109?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43109?
Apply the vendor's patch.
Is CVE-2026-43109 being exploited?
There is no known exploitation of CVE-2026-43109 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43109, DEBIAN-CVE-2026-43109, GHSA-463m-22hh-chvm, ROOT-OS-DEBIAN-11-CVE-2026-43109, ROOT-OS-DEBIAN-12-CVE-2026-43109, ROOT-OS-DEBIAN-13-CVE-2026-43109 and 3 more.