---
id: CVE-2026-43244
title: 'kcm: fix zero-frag skb in frag_list on partial sendmsg error'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  kcm: fix zero-frag skb in frag_list on partial sendmsg error

  Syzkaller reported a warning in kcm_write_msgs() when processing a
  message with a zero-fragment skb in the…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    6f129a251c2795ba55dd5cc1fdf7e0af3098d848
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    9ea3671d70ee07480d80bebe86696397c4e99fb7
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    b1e3edf688a88c1a3ac41657055d9c136a08cd25
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    7af58f76e4b404a74c836881a845e6652db8a09f
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    ca220141fa8ebae09765a242076b2b77338106b0
  - Linux 4.6
published: '2026-05-06'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:40:22.099Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43244'
references:
  - url: 'https://git.kernel.org/stable/c/6f129a251c2795ba55dd5cc1fdf7e0af3098d848'
  - url: 'https://git.kernel.org/stable/c/9ea3671d70ee07480d80bebe86696397c4e99fb7'
  - url: 'https://git.kernel.org/stable/c/b1e3edf688a88c1a3ac41657055d9c136a08cd25'
  - url: 'https://git.kernel.org/stable/c/7af58f76e4b404a74c836881a845e6652db8a09f'
  - url: 'https://git.kernel.org/stable/c/ca220141fa8ebae09765a242076b2b77338106b0'
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.04966
ingestedAt: '2026-10-21T12:48:53.644Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

kcm: fix zero-frag skb in frag_list on partial sendmsg error

Syzkaller reported a warning in kcm_write_msgs() when processing a
message with a zero-fragment skb in the frag_list.

When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,
it allocates a new skb (tskb) and links it into the frag_list before
copying data. If the copy subsequently fails (e.g. -EFAULT from
user memory), tskb remains in the frag_list with zero fragments:

  head skb (msg being assembled, NOT yet in sk_write_queue)
  +-----------+
  | frags[17] |  (MAX_SKB_FRAGS, all filled with data)
  | frag_list-+--> tskb
  +-----------+    +----------+
                   | frags[0] |  (empty! copy failed before filling)
                   +----------+

For SOCK_SEQPACKET with partial data already copied, the error path
saves this message via partial_message for later completion. For
SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a
subsequent zero-length write(fd, NULL, 0) completes the message and
queues it to sk_write_queue. kcm_write_msgs() then walks the
frag_list and hits:

  WARN_ON(!skb_shinfo(skb)->nr_frags)

TCP has a similar pattern where skbs are enqueued before data copy
and cleaned up on failure via tcp_remove_empty_skb(). KCM was
missing the equivalent cleanup.

Fix this by tracking the predecessor skb (frag_prev) when allocating
a new frag_list entry. On error, if the tail skb has zero frags,
use frag_prev to unlink and free it in O(1) without walking the
singly-linked frag_list. frag_prev is safe to dereference because
the entire message chain is only held locally (or in kcm->seq_skb)
and is not added to sk_write_queue until MSG_EOR, so the send path
cannot free it underneath us.

Also change the WARN_ON to WARN_ON_ONCE to avoid flooding the log
if the condition is somehow hit repeatedly.

There are currently no KCM selftests in the kernel tree; a simple
reproducer is available at [1].

[1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa

## Affected

- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 6f129a251c2795ba55dd5cc1fdf7e0af3098d848`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 9ea3671d70ee07480d80bebe86696397c4e99fb7`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < b1e3edf688a88c1a3ac41657055d9c136a08cd25`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 7af58f76e4b404a74c836881a845e6652db8a09f`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < ca220141fa8ebae09765a242076b2b77338106b0`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.