CVE-2026-43039
published 2026-05-01CVE-2026-43039: In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.31%
22.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
emac_dispatch_skb_zc() allocates a new skb via napi_alloc_skb() but
never copies the packet data from the XDP buffer into it. The skb is
passed up the stack containing uninitialized heap memory instead of
the actual received packet, leaking kernel heap contents to userspace.
Copy the received packet data from the XDP buffer into the skb using
skb_copy_to_linear_data().
Additionally, remove the skb_mark_for_recycle() call since the skb is
backed by the NAPI page frag allocator, not page_pool. Marking a
non-page_pool skb for recycle causes the free path to return pages to
a page_pool that does not own them, corrupting page_pool state.
The non-ZC path (emac_rx_packet) does not have these issues because it
uses napi_build_skb() to wrap the existing page_pool page directly,
requiring no copy, and correctly marks for recycle since the page comes
from page_pool_dev_alloc_pages().
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 7a64bb388df3cf091afdd047c701039a13acd3b4 < a968438d4fc17ee1dcdc3cfa490dcb5e7709cf76 | a968438d4fc17ee1dcdc3cfa490dcb5e7709cf76 |
| linux | linux | >= 7a64bb388df3cf091afdd047c701039a13acd3b4 < 5597dd284ff8c556c0b00f6a34473677426e3f81 | 5597dd284ff8c556c0b00f6a34473677426e3f81 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.19 < 6.19.12 | 6.19.12 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
vendor_redhat·2026-05-01
CVE-2026-43039 CWE-909 kernel: net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
kernel: net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
A flaw was found in the Linux kernel's `icssg-prueth` network driver. This vulnerability allows for information disclosure, where uninitialized kernel memory contents can be exposed to user applications. This occurs because the driver fails to properly copy received packet data into a network buffer before passing it up the system's network stack. This could allow a local user to access sensitive system information.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux
GHSA
GHSA-958g-8q2h-mvmg: In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
ghsa_unreviewed·2026-05-01
CVE-2026-43039 [CRITICAL] GHSA-958g-8q2h-mvmg: In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
emac_dispatch_skb_zc() allocates a new skb via napi_alloc_skb() but
never copies the packet data from the XDP buffer into it. The skb is
passed up the stack containing uninitialized heap memory instead of
the actual received packet, leaking kernel heap contents to userspace.
Copy the received packet data from the XDP buffer into the skb using
skb_copy_to_linear_data().
Additionally, remove the skb_mark_for_recycle() call since the skb is
backed by the NAPI page frag allocator, not page_pool. Marking a
non-page_pool skb for recycle causes the free path to return pages to
a page_pool that does not own them, corrupting page_pool state.
The n
VulDB
Linux Kernel up to 6.19.11 NAPI Page emac_dispatch_skb_zc uninitialized pointer
vuldb·2026-05-01
CVE-2026-43039 [CRITICAL] Linux Kernel up to 6.19.11 NAPI Page emac_dispatch_skb_zc uninitialized pointer
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.19.11. This vulnerability affects the function emac_dispatch_skb_zc of the component NAPI Page. Such manipulation leads to uninitialized pointer.
This vulnerability is traded as CVE-2026-43039. Access to the local network is required for this attack to succeed. There is no exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-05-01
Published