CVE-2026-43190 netfilter: xt_tcpmss: check remaining length before reading optlen
A missing length check in the Linux kernel netfilter TCP MSS module allows out-of-bounds reads, potentially leading to information disclosure or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43190?
CVE-2026-43190 is a high-severity memory corruption vulnerability in Linux kernel, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_tcpmss: check remaining length before reading optlen
Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining option length.
If the last byte of the option field is not EOL/NOP (0/1), the code attempts to index op[i+1]. In the case where i + 1 == optlen, this causes an out-of-bounds read, accessing memory past the optlen boundary (either reading beyond the stack buffer _opt or the following payload).
Weakness: CWE-125
Which versions are affected by CVE-2026-43190?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43190?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43190 being exploited?
There is no known exploitation of CVE-2026-43190 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43190, DEBIAN-CVE-2026-43190, GHSA-395h-h5jq-ggp6, ROOT-OS-DEBIAN-11-CVE-2026-43190, ROOT-OS-UBUNTU-2204-CVE-2026-43190, ROOT-OS-UBUNTU-2404-CVE-2026-43190 and 1 more.