CVE-2026-43208
- Source
- https://cve.org/CVERecord?id=CVE-2026-43208
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43208.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-43208
- Downstream
- Published
- 2026-05-06T11:28:12.292Z
- Modified
- 2026-07-08T08:13:28.590763430Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- net: do not pass flow_id to set_rps_cpu()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: do not pass flowid to setrps_cpu()
Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change.
Compute flowid in setrpscpu(), do not assume we can use the value computed by getrps_cpu(). Otherwise we risk out-of-bound access and/or crashes.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43208.json" }- References
-
- https://git.kernel.org/stable/c/5455a232edea6b946b99449f15ca771a8874a5a6
- https://git.kernel.org/stable/c/8a8a9fac9efa6423fd74938b940cb7d731780718
- https://git.kernel.org/stable/c/ed712dc0d64dee5f0d05e4d8ca57711f8a9c850c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43208.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-43208
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git