CVE-2026-43088

A flaw was found in the Linux kernel's AF_KEY networking component. When handling PF_KEY export paths, the pfkey_sockaddr_fill() function does not fully initialize sockaddr_in6 structures, leaving 4 bytes of memory uninitialized. This can lead to the disclosure of potentially sensitive information from the kernel's memory.

This flaw is rated as a Moderate impact because an attacker must have local access with CAP_NET_ADMIN capabilities (or unprivileged user namespaces enabled) to create PF_KEY sockets and inspect exported messages. Exploitation is constrained to reading a small amount of residual kernel memory—specifically four trailing padding bytes within IPv6 socket address structures—rather than achieving code execution or arbitrary memory access. Standard Red Hat Enterprise Linux configurations do not use PF_KEY by default, as contemporary IPsec deployments rely on the XFRM Netlink interface instead.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.