{"id":"CVE-2026-43107","title":"xfrm: account XFRMA_IF_ID in aevent size calculation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: account XFRMA_IF_ID in aevent size calculation\n\nxfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then\nbuild_aevent() appends attributes including…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < f8f3bb89ab677db15f9f5250c77af728f9afe995","Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 2c41283d94af943a05f7f2cc1a01f0c872f3cf43","Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < e62e322ea20be78e346e4b49f9a6b9f03313af4c","Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 58e5735d1a5373652f405a0c16e54ac04aaab0ad","Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 7081d46d32312f1a31f0e0e99c6835a394037599","Linux 4.19"],"published":"2026-05-06","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:40:04.294Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43107","references":[{"url":"https://git.kernel.org/stable/c/f8f3bb89ab677db15f9f5250c77af728f9afe995"},{"url":"https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43"},{"url":"https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c"},{"url":"https://git.kernel.org/stable/c/58e5735d1a5373652f405a0c16e54ac04aaab0ad"},{"url":"https://git.kernel.org/stable/c/7081d46d32312f1a31f0e0e99c6835a394037599"}],"tags":["cve.org"],"epss":0.00162,"epssPercentile":0.04963,"ingestedAt":"2026-10-21T12:48:53.647Z","slug":"CVE-2026-43107","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: account XFRMA_IF_ID in aevent size calculation\n\nxfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then\nbuild_aevent() appends attributes including XFRMA_IF_ID when x->if_id is\nset.\n\nxfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states\nwith if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0)\nin xfrm_get_ae(), turning a malformed netlink interaction into a kernel\npanic.\n\nAccount XFRMA_IF_ID in the size calculation unconditionally and replace\nthe BUG_ON with normal error unwinding.\n\n## Affected\n\n- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < f8f3bb89ab677db15f9f5250c77af728f9afe995`\n- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 2c41283d94af943a05f7f2cc1a01f0c872f3cf43`\n- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < e62e322ea20be78e346e4b49f9a6b9f03313af4c`\n- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 58e5735d1a5373652f405a0c16e54ac04aaab0ad`\n- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 7081d46d32312f1a31f0e0e99c6835a394037599`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}