CVE-2026-43107

A flaw was found in the Linux kernel's xfrm subsystem. A remote attacker could send a specially crafted netlink message that, due to an incorrect size calculation when handling XFRMA_IF_ID attributes, would lead to a buffer overflow. This issue could cause a kernel panic, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate severity because exploitation requires local access to send Netlink messages to the IPsec transform subsystem, restricting the blast radius to a denial of service without arbitrary code execution or data exposure. Under default Red Hat Enterprise Linux configurations, interacting with XFRM netlink sockets requires administrative network privileges, although environments permitting unprivileged user namespaces may expose the subsystem to unprivileged local users. The issue specifically occurs when states are configured with an interface identifier, meaning systems without configured XFRM interfaces are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.