GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43244 (GCVE-0-2026-43244)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-05-11 22:20
VLAI
Title
kcm: fix zero-frag skb in frag_list on partial sendmsg error
Summary
In the Linux kernel, the following vulnerability has been resolved: kcm: fix zero-frag skb in frag_list on partial sendmsg error Syzkaller reported a warning in kcm_write_msgs() when processing a message with a zero-fragment skb in the frag_list. When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb, it allocates a new skb (tskb) and links it into the frag_list before copying data. If the copy subsequently fails (e.g. -EFAULT from user memory), tskb remains in the frag_list with zero fragments: head skb (msg being assembled, NOT yet in sk_write_queue) +-----------+ | frags[17] | (MAX_SKB_FRAGS, all filled with data) | frag_list-+--> tskb +-----------+ +----------+ | frags[0] | (empty! copy failed before filling) +----------+ For SOCK_SEQPACKET with partial data already copied, the error path saves this message via partial_message for later completion. For SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a subsequent zero-length write(fd, NULL, 0) completes the message and queues it to sk_write_queue. kcm_write_msgs() then walks the frag_list and hits: WARN_ON(!skb_shinfo(skb)->nr_frags) TCP has a similar pattern where skbs are enqueued before data copy and cleaned up on failure via tcp_remove_empty_skb(). KCM was missing the equivalent cleanup. Fix this by tracking the predecessor skb (frag_prev) when allocating a new frag_list entry. On error, if the tail skb has zero frags, use frag_prev to unlink and free it in O(1) without walking the singly-linked frag_list. frag_prev is safe to dereference because the entire message chain is only held locally (or in kcm->seq_skb) and is not added to sk_write_queue until MSG_EOR, so the send path cannot free it underneath us. Also change the WARN_ON to WARN_ON_ONCE to avoid flooding the log if the condition is somehow hit repeatedly. There are currently no KCM selftests in the kernel tree; a simple reproducer is available at [1]. [1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 9ea3671d70ee07480d80bebe86696397c4e99fb7 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < b1e3edf688a88c1a3ac41657055d9c136a08cd25 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 7af58f76e4b404a74c836881a845e6652db8a09f (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < ca220141fa8ebae09765a242076b2b77338106b0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9ea3671d70ee07480d80bebe86696397c4e99fb7",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "b1e3edf688a88c1a3ac41657055d9c136a08cd25",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "7af58f76e4b404a74c836881a845e6652db8a09f",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "ca220141fa8ebae09765a242076b2b77338106b0",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: fix zero-frag skb in frag_list on partial sendmsg error\n\nSyzkaller reported a warning in kcm_write_msgs() when processing a\nmessage with a zero-fragment skb in the frag_list.\n\nWhen kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,\nit allocates a new skb (tskb) and links it into the frag_list before\ncopying data. If the copy subsequently fails (e.g. -EFAULT from\nuser memory), tskb remains in the frag_list with zero fragments:\n\n  head skb (msg being assembled, NOT yet in sk_write_queue)\n  +-----------+\n  | frags[17] |  (MAX_SKB_FRAGS, all filled with data)\n  | frag_list-+--\u003e tskb\n  +-----------+    +----------+\n                   | frags[0] |  (empty! copy failed before filling)\n                   +----------+\n\nFor SOCK_SEQPACKET with partial data already copied, the error path\nsaves this message via partial_message for later completion. For\nSOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a\nsubsequent zero-length write(fd, NULL, 0) completes the message and\nqueues it to sk_write_queue. kcm_write_msgs() then walks the\nfrag_list and hits:\n\n  WARN_ON(!skb_shinfo(skb)-\u003enr_frags)\n\nTCP has a similar pattern where skbs are enqueued before data copy\nand cleaned up on failure via tcp_remove_empty_skb(). KCM was\nmissing the equivalent cleanup.\n\nFix this by tracking the predecessor skb (frag_prev) when allocating\na new frag_list entry. On error, if the tail skb has zero frags,\nuse frag_prev to unlink and free it in O(1) without walking the\nsingly-linked frag_list. frag_prev is safe to dereference because\nthe entire message chain is only held locally (or in kcm-\u003eseq_skb)\nand is not added to sk_write_queue until MSG_EOR, so the send path\ncannot free it underneath us.\n\nAlso change the WARN_ON to WARN_ON_ONCE to avoid flooding the log\nif the condition is somehow hit repeatedly.\n\nThere are currently no KCM selftests in the kernel tree; a simple\nreproducer is available at [1].\n\n[1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:20:47.856Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9ea3671d70ee07480d80bebe86696397c4e99fb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1e3edf688a88c1a3ac41657055d9c136a08cd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/7af58f76e4b404a74c836881a845e6652db8a09f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca220141fa8ebae09765a242076b2b77338106b0"
        }
      ],
      "title": "kcm: fix zero-frag skb in frag_list on partial sendmsg error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43244",
    "datePublished": "2026-05-06T11:28:36.946Z",
    "dateReserved": "2026-05-01T14:12:55.995Z",
    "dateUpdated": "2026-05-11T22:20:47.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43244",
      "date": "2026-09-16",
      "epss": "0.00122",
      "percentile": "0.02286"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:45:31.000Z",
      "cve": "CVE-2026-43244",
      "id": "msrc_CVE-2026-43244",
      "initial_release_date": "2026-05-07T01:07:39.000Z",
      "product_status:known_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "kcm: fix zero-frag skb in frag_list on partial sendmsg error",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43244.json",
      "version": "9"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43244\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:44.873\",\"lastModified\":\"2026-06-17T10:49:13.640\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkcm: fix zero-frag skb in frag_list on partial sendmsg error\\n\\nSyzkaller reported a warning in kcm_write_msgs() when processing a\\nmessage with a zero-fragment skb in the frag_list.\\n\\nWhen kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,\\nit allocates a new skb (tskb) and links it into the frag_list before\\ncopying data. If the copy subsequently fails (e.g. -EFAULT from\\nuser memory), tskb remains in the frag_list with zero fragments:\\n\\n  head skb (msg being assembled, NOT yet in sk_write_queue)\\n  +-----------+\\n  | frags[17] |  (MAX_SKB_FRAGS, all filled with data)\\n  | frag_list-+--\u003e tskb\\n  +-----------+    +----------+\\n                   | frags[0] |  (empty! copy failed before filling)\\n                   +----------+\\n\\nFor SOCK_SEQPACKET with partial data already copied, the error path\\nsaves this message via partial_message for later completion. For\\nSOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a\\nsubsequent zero-length write(fd, NULL, 0) completes the message and\\nqueues it to sk_write_queue. kcm_write_msgs() then walks the\\nfrag_list and hits:\\n\\n  WARN_ON(!skb_shinfo(skb)-\u003enr_frags)\\n\\nTCP has a similar pattern where skbs are enqueued before data copy\\nand cleaned up on failure via tcp_remove_empty_skb(). KCM was\\nmissing the equivalent cleanup.\\n\\nFix this by tracking the predecessor skb (frag_prev) when allocating\\na new frag_list entry. On error, if the tail skb has zero frags,\\nuse frag_prev to unlink and free it in O(1) without walking the\\nsingly-linked frag_list. frag_prev is safe to dereference because\\nthe entire message chain is only held locally (or in kcm-\u003eseq_skb)\\nand is not added to sk_write_queue until MSG_EOR, so the send path\\ncannot free it underneath us.\\n\\nAlso change the WARN_ON to WARN_ON_ONCE to avoid flooding the log\\nif the condition is somehow hit repeatedly.\\n\\nThere are currently no KCM selftests in the kernel tree; a simple\\nreproducer is available at [1].\\n\\n[1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/kcm/kcmsock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ab7ac4eb9832e32a09f4e8042705484d2fb0aad3\",\"lessThan\":\"9ea3671d70ee07480d80bebe86696397c4e99fb7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab7ac4eb9832e32a09f4e8042705484d2fb0aad3\",\"lessThan\":\"b1e3edf688a88c1a3ac41657055d9c136a08cd25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab7ac4eb9832e32a09f4e8042705484d2fb0aad3\",\"lessThan\":\"7af58f76e4b404a74c836881a845e6652db8a09f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab7ac4eb9832e32a09f4e8042705484d2fb0aad3\",\"lessThan\":\"ca220141fa8ebae09765a242076b2b77338106b0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/kcm/kcmsock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.6\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BF0012BC-1AAF-4F0D-B9C8-FC13D91F000E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7af58f76e4b404a74c836881a845e6652db8a09f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ea3671d70ee07480d80bebe86696397c4e99fb7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1e3edf688a88c1a3ac41657055d9c136a08cd25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ca220141fa8ebae09765a242076b2b77338106b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:36:21+00:00",
      "cve": "CVE-2026-43244",
      "id": "CVE-2026-43244",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kcm: fix zero-frag skb in frag_list on partial sendmsg error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43244.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:19:33Z",
      "cve": "CVE-2026-43244",
      "id": "CVE-2026-43244",
      "initial_release_date": "2026-05-07T02:16:51Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "643",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43244",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43244.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.