Medium 5.5Published May 6, 2026

CVE-2026-43107xfrm: account XFRMA_IF_ID in aevent size calculation

Updated under an hour ago (Oct 28, 2026, 1:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfrm: account XFRMA_IF_ID in aevent size calculation xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then build_aevent() appends attributes including XFRMA_IF_ID when x->if_id is set. xfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states with if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0) in xfrm_get_ae(), turning a malformed netlink interaction into a kernel panic. Account XFRMA_IF_ID in the size calculation unconditionally and replace the BUG_ON with normal error unwinding.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7e6526404adedf079279aa7aa11722deaca8fe2e before f8f3bb89ab677db15f9f5250c77af728f9afe995; 7e6526404adedf079279aa7aa11722deaca8fe2e builds before 2c41283d94af943a05f7f2cc1a01f0c872f3cf43; from 7e6526404adedf079279aa7aa11722deaca8fe2e before e62e322ea20be78e346e4b49f9a6b9f03313af4c; from 7e6526404adedf079279aa7aa11722deaca8fe2e before 58e5735d1a5373652f405a0c16e54ac04aaab0ad; from 7e6526404adedf079279aa7aa11722deaca8fe2e before 7081d46d32312f1a31f0e0e99c6835a394037599	CNA record
linux linux_kernel linux:linux_kernel	from 4.19 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/f8f3bb89ab677db15f9f5250c77af728f9afe995
https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43	patch
https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c	patch
https://git.kernel.org/stable/c/58e5735d1a5373652f405a0c16e54ac04aaab0ad	patch
https://git.kernel.org/stable/c/7081d46d32312f1a31f0e0e99c6835a394037599	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.