CVE-2026-43208

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: do not pass flow_id to set_rps_cpu()

Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change.

Compute flow_id in set_rps_cpu(), do not assume we can use the value computed by get_rps_cpu(). Otherwise we risk out-of-bound access and/or crashes.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= 48aa30443e52c9666d5cd5e67532e475f212337e, < 5455a232edea6b946b99449f15ca771a8874a5a6; >= 48aa30443e52c9666d5cd5e67532e475f212337e, < ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c; >= 48aa30443e52c9666d5cd5e67532e475f212337e, < 8a8a9fac9efa6423fd74938b940cb7d731780718
LinuxLinux6.18

References

Timeline

Published
May 6, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-432095.5In the Linux kernel, the following vulnerability has been resolved: minix: Add required sanity checking to minix_check_superblock() The fsCVE-2026-43219.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital CVE-2026-432105.5In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check theCVE-2026-432117.8In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: CVE-2026-432127.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE The archCVE-2026-432137.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate sequence number of TX release report HardwaCVE-2026-432147.8In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() AddCVE-2026-432158.8In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_seCVE-2026-432165.5In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp() maCVE-2026-432175.5In the Linux kernel, the following vulnerability has been resolved: media: iris: gen2: Add sanity check for session stop In iris_kill_sessCVE-2026-432185.5In the Linux kernel, the following vulnerability has been resolved: media: i2c/tw9903: Fix potential memory leak in tw9903_probe() In one CVE-2026-432195.5In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: Fix potential unregister of netdev that has not been reg
CVE-2026-43208: Critical severity, CVSS 9.8 | Vulnix