CVE-2026-43029 (GCVE-0-2026-43029)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-08-05 12:25
VLAI
Title
mptcp: fix soft lockup in mptcp_recvmsg()
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix soft lockup in mptcp_recvmsg() syzbot reported a soft lockup in mptcp_recvmsg() [0]. When receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not removed from the sk_receive_queue. This causes sk_wait_data() to always find available data and never perform actual waiting, leading to a soft lockup. Fix this by adding a 'last' parameter to track the last peeked skb. This allows sk_wait_data() to make informed waiting decisions and prevent infinite loops when MSG_PEEK is used. [0]: watchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963] Modules linked in: CPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_wait_data+0x15/0x190 Code: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb <48> 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b RSP: 0018:ffffc90000603ca0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101 R10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18 R13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000 FS: 00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0 Call Trace: <TASK> mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329 inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891 sock_recvmsg+0x94/0xc0 net/socket.c:1100 __sys_recvfrom+0xb2/0x130 net/socket.c:2256 __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267 do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131 RIP: 0033:0x7f6e386a4a1d Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41 RSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d RDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004 RBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0 R13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000 </TASK>
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8e04ce45a8db7a080220e86e249198fa676b83dc , < 58b58b9ba89c43914eea90c18928e51852d10c24 (git)
Affected: 8e04ce45a8db7a080220e86e249198fa676b83dc , < de3c248d1b69eaefa2d5b3da4005936dcf590f1b (git)
Affected: 8e04ce45a8db7a080220e86e249198fa676b83dc , < 5dd8025a49c268ab6b94d978532af3ad341132a7 (git)
Affected: 49888b3b457b801282b44c246d289c56e2f2a55b (git)
Affected: 0206a9341e652167c610dcd79f3d4e9e8153984c (git)
Affected: 7d6d10eee01edc9c20850ea75cf8273dc1170921 (git)
Affected: 6.6.117 , < 6.7 (semver)
Affected: 6.12.59 , < 6.13 (semver)
Affected: 6.17.8 , < 6.18 (semver)
Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.22 , ≤ 6.18.* (semver)
Unaffected: 6.19.12 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58b58b9ba89c43914eea90c18928e51852d10c24",
              "status": "affected",
              "version": "8e04ce45a8db7a080220e86e249198fa676b83dc",
              "versionType": "git"
            },
            {
              "lessThan": "de3c248d1b69eaefa2d5b3da4005936dcf590f1b",
              "status": "affected",
              "version": "8e04ce45a8db7a080220e86e249198fa676b83dc",
              "versionType": "git"
            },
            {
              "lessThan": "5dd8025a49c268ab6b94d978532af3ad341132a7",
              "status": "affected",
              "version": "8e04ce45a8db7a080220e86e249198fa676b83dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "49888b3b457b801282b44c246d289c56e2f2a55b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0206a9341e652167c610dcd79f3d4e9e8153984c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7d6d10eee01edc9c20850ea75cf8273dc1170921",
              "versionType": "git"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.117",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix soft lockup in mptcp_recvmsg()\n\nsyzbot reported a soft lockup in mptcp_recvmsg() [0].\n\nWhen receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not\nremoved from the sk_receive_queue. This causes sk_wait_data() to always\nfind available data and never perform actual waiting, leading to a soft\nlockup.\n\nFix this by adding a \u0027last\u0027 parameter to track the last peeked skb.\nThis allows sk_wait_data() to make informed waiting decisions and prevent\ninfinite loops when MSG_PEEK is used.\n\n[0]:\nwatchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963]\nModules linked in:\nCPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:sk_wait_data+0x15/0x190\nCode: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb \u003c48\u003e 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b\nRSP: 0018:ffffc90000603ca0 EFLAGS: 00000246\nRAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001\nRDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800\nRBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101\nR10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18\nR13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000\nFS:  00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329\n inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891\n sock_recvmsg+0x94/0xc0 net/socket.c:1100\n __sys_recvfrom+0xb2/0x130 net/socket.c:2256\n __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267\n do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131\nRIP: 0033:0x7f6e386a4a1d\nCode: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41\nRSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d\nRAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d\nRDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004\nRBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0\nR13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000\n \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - MPTCP is a TCP-based network protocol, and in a reasonable network-facing MPTCP service using recv with MSG_PEEK|MSG_WAITALL, a remote peer can populate the receive queue and trigger the vulnerable receive path by sending insufficient data. The vulnerable function is reached through normal socket receive handling for MPTCP data.\nAC:L - No race, memory layout, or hard-to-control timing is required; once the target performs the blocking peek receive, the attacker controls whether the receive queue contains the same partial data that causes the loop. The condition is reliably repeatable.\nPR:N - A remote peer does not need local credentials or kernel capabilities to connect to an exposed MPTCP service and send data before authentication. MPTCP socket creation itself has no capability gate and is enabled by default when configured.\nUI:N - No human user action is required after the vulnerable service is running. The trigger is normal network traffic plus the service\u0027s receive call.\nS:U - The impact is a kernel availability failure on the same host/security authority. It does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug is an infinite receive/wait loop caused by MSG_PEEK retaining the skb on the receive queue. There is no memory corruption or information disclosure primitive.\nI:N - The fix and code path show no unauthorized write, data modification, or control-flow corruption. The observed failure is a soft lockup only.\nA:H - The bug causes sk_wait_data to return immediately forever, producing a kernel soft lockup with a CPU stuck for an extended period. Repeated connections could consume availability, so the availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:22.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58b58b9ba89c43914eea90c18928e51852d10c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/de3c248d1b69eaefa2d5b3da4005936dcf590f1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7"
        }
      ],
      "title": "mptcp: fix soft lockup in mptcp_recvmsg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43029",
    "datePublished": "2026-05-01T14:15:29.885Z",
    "dateReserved": "2026-05-01T14:12:55.976Z",
    "dateUpdated": "2026-08-05T12:25:22.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43029",
      "date": "2026-08-10",
      "epss": "0.00329",
      "percentile": "0.2546"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T14:15:01.000Z",
      "cve": "CVE-2026-43029",
      "id": "msrc_CVE-2026-43029",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mptcp: fix soft lockup in mptcp_recvmsg()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43029.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43029\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T15:16:47.427\",\"lastModified\":\"2026-06-17T10:48:47.810\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix soft lockup in mptcp_recvmsg()\\n\\nsyzbot reported a soft lockup in mptcp_recvmsg() [0].\\n\\nWhen receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not\\nremoved from the sk_receive_queue. This causes sk_wait_data() to always\\nfind available data and never perform actual waiting, leading to a soft\\nlockup.\\n\\nFix this by adding a \u0027last\u0027 parameter to track the last peeked skb.\\nThis allows sk_wait_data() to make informed waiting decisions and prevent\\ninfinite loops when MSG_PEEK is used.\\n\\n[0]:\\nwatchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963]\\nModules linked in:\\nCPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none)\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\\nRIP: 0010:sk_wait_data+0x15/0x190\\nCode: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb \u003c48\u003e 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b\\nRSP: 0018:ffffc90000603ca0 EFLAGS: 00000246\\nRAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001\\nRDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800\\nRBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101\\nR10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18\\nR13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000\\nFS:  00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0\\nCall Trace:\\n \u003cTASK\u003e\\n mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329\\n inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891\\n sock_recvmsg+0x94/0xc0 net/socket.c:1100\\n __sys_recvfrom+0xb2/0x130 net/socket.c:2256\\n __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267\\n do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131\\nRIP: 0033:0x7f6e386a4a1d\\nCode: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41\\nRSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d\\nRAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d\\nRDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004\\nRBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000\\nR10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0\\nR13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000\\n \u003c/TASK\u003e\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mptcp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8e04ce45a8db7a080220e86e249198fa676b83dc\",\"lessThan\":\"58b58b9ba89c43914eea90c18928e51852d10c24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8e04ce45a8db7a080220e86e249198fa676b83dc\",\"lessThan\":\"de3c248d1b69eaefa2d5b3da4005936dcf590f1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8e04ce45a8db7a080220e86e249198fa676b83dc\",\"lessThan\":\"5dd8025a49c268ab6b94d978532af3ad341132a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"49888b3b457b801282b44c246d289c56e2f2a55b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0206a9341e652167c610dcd79f3d4e9e8153984c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d6d10eee01edc9c20850ea75cf8273dc1170921\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.117\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.59\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.17.8\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mptcp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.22\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.12\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18.1\",\"versionEndExcluding\":\"6.18.22\",\"matchCriteriaId\":\"BF0DA3C1-164D-4E48-AFBD-FE1A0F1A543C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.12\",\"matchCriteriaId\":\"0A2B9540-02D5-41B4-B16A-82AF66FD4F36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6.117:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90B17019-1656-4C00-8CB7-2649D560B4EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12.59:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B487205C-BC17-48F9-BFBE-12BFDF95DF88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5992D35-DBEB-42E4-8BC5-F2B9A54A4D15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCE57113-2223-4308-A0F2-5E6ECFBB3C23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2545FB83-C4A6-4F62-9ED1-09F75D2E3C78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"38C4D89F-9A13-4D29-8645-C9785C142C07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/58b58b9ba89c43914eea90c18928e51852d10c24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de3c248d1b69eaefa2d5b3da4005936dcf590f1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T13:05:24+00:00",
      "cve": "CVE-2026-43029",
      "id": "CVE-2026-43029",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: fix soft lockup in mptcp_recvmsg()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43029.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:22:04Z",
      "cve": "CVE-2026-43029",
      "id": "CVE-2026-43029",
      "initial_release_date": "2026-05-06T01:41:12Z",
      "product_status:known_not_affected": "291",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43029",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43029.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.