CVE-2026-43194

{"id": "CVE-2026-43194", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43194", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:15:33.086663Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "ae3f627b45fbc3c776a4e484696f3cad7cbb4eca", "versionType": "git"}, {"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "0c9de092ef8c50a7ee9612811566f0aa81d8d7b6", "versionType": "git"}, {"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "56bd32c0edca34041a5c215887fcf562fae2e2db", "versionType": "git"}, {"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "9ac6aebef4b4bfc5ed408b0b65645981574bc780", "versionType": "git"}, {"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5", "versionType": "git"}, {"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "4cb163e9efcac4cd35c3043e097f25081a5c015c", "versionType": "git"}, {"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "c86901d22c89a6bf4e2f013e948aaabc60869893", "versionType": "git"}, {"status": "affected", "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "7aa767d0d3d04e50ae94e770db7db8197f666970", "versionType": "git"}], "programFiles": ["net/core/dev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.18"}, {"status": "unaffected", "version": "0", "lessThan": "3.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.252", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.202", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.165", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.128", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/dev.c"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:38.310", "references": [{"url": "https://git.kernel.org/stable/c/0c9de092ef8c50a7ee9612811566f0aa81d8d7b6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4cb163e9efcac4cd35c3043e097f25081a5c015c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/56bd32c0edca34041a5c215887fcf562fae2e2db", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7aa767d0d3d04e50ae94e770db7db8197f666970", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9ac6aebef4b4bfc5ed408b0b65645981574bc780", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ae3f627b45fbc3c776a4e484696f3cad7cbb4eca", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c86901d22c89a6bf4e2f013e948aaabc60869893", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: consume xmit errors of GSO frames\n\nudpgro_frglist.sh and udpgro_bench.sh are the flakiest tests\ncurrently in NIPA. They fail in the same exact way, TCP GRO\ntest stalls occasionally and the test gets killed after 10min.\n\nThese tests use veth to simulate GRO. They attach a trivial\n(\"return XDP_PASS;\") XDP program to the veth to force TSO off\nand NAPI on.\n\nDigging into the failure mode we can see that the connection\nis completely stuck after a burst of drops. The sender's snd_nxt\nis at sequence number N [1], but the receiver claims to have\nreceived (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle\nis that senders rtx queue is not empty (let's say the block in\nthe rtx queue is at sequence number N - 4 * MSS [3]).\n\nIn this state, sender sends a retransmission from the rtx queue\nwith a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].\nReceiver sees it and responds with an ACK all the way up to\nN + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA\nbecause it has no recollection of ever sending data that far out [1].\nAnd we are stuck.\n\nThe root cause is the mess of the xmit return codes. veth returns\nan error when it can't xmit a frame. We end up with a loss event\nlike this:\n\n -------------------------------------------------\n | GSO super frame 1 | GSO super frame 2 |\n |-----------------------------------------------|\n | seg | seg | seg | seg | seg | seg | seg | seg |\n | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |\n -------------------------------------------------\n x ok ok <ok>| ok ok ok <x>\n \\\\\n\t\t\t snd_nxt\n\n\"x\" means packet lost by veth, and \"ok\" means it went thru.\nSince veth has TSO disabled in this test it sees individual segments.\nSegment 1 is on the retransmit queue and will be resent.\n\nSo why did the sender not advance snd_nxt even tho it clearly did\nsend up to seg 8? tcp_write_xmit() interprets the return code\nfrom the core to mean that data has not been sent at all. Since\nTCP deals with GSO super frames, not individual segment the crux\nof the problem is that loss of a single segment can be interpreted\nas loss of all. TCP only sees the last return code for the last\nsegment of the GSO frame (in <> brackets in the diagram above).\n\nOf course for the problem to occur we need a setup or a device\nwithout a Qdisc. Otherwise Qdisc layer disconnects the protocol\nlayer from the device errors completely.\n\nWe have multiple ways to fix this.\n\n 1) make veth not return an error when it lost a packet.\n While this is what I think we did in the past, the issue keeps\n reappearing and it's annoying to debug. The game of whack\n a mole is not great.\n\n 2) fix the damn return codes\n We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the\n documentation, so maybe we should make the return code from\n ndo_start_xmit() a boolean. I like that the most, but perhaps\n some ancient, not-really-networking protocol would suffer.\n\n 3) make TCP ignore the errors\n It is not entirely clear to me what benefit TCP gets from\n interpreting the result of ip_queue_xmit()? Specifically once\n the connection is established and we're pushing data - packet\n loss is just packet loss?\n\n 4) this fix\n Ignore the rc in the Qdisc-less+GSO case, since it's unreliable.\n We already always return OK in the TCQ_F_CAN_BYPASS case.\n In the Qdisc-less case let's be a bit more conservative and only\n mask the GSO errors. This path is taken by non-IP-\"networks\"\n like CAN, MCTP etc, so we could regress some ancient thing.\n This is the simplest, but also maybe the hackiest fix?\n\nSimilar fix has been proposed by Eric in the past but never committed\nbecause original reporter was working with an OOT driver and wasn't\nproviding feedback (see Link)."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net: consumir errores de xmit de tramas GSO udpgro_frglist.sh y udpgro_bench.sh son las pruebas m\u00e1s inestables actualmente en NIPA. Fallan exactamente de la misma manera, la prueba TCP GRO se detiene ocasionalmente y la prueba se interrumpe despu\u00e9s de 10 minutos. Estas pruebas usan veth para simular GRO. Adjuntan un programa XDP trivial (\u2019return XDP_PASS;\u2019) al veth para forzar la desactivaci\u00f3n de TSO y la activaci\u00f3n de NAPI. Al investigar el modo de fallo podemos ver que la conexi\u00f3n est\u00e1 completamente atascada despu\u00e9s de una r\u00e1faga de ca\u00eddas. El snd_nxt del remitente est\u00e1 en el n\u00famero de secuencia N [1], pero el receptor afirma haber recibido (rcv_nxt) hasta N + 3 * MSS [2]. La \u00faltima pieza del rompecabezas es que la cola rtx del remitente no est\u00e1 vac\u00eda (digamos que el bloque en la cola rtx est\u00e1 en el n\u00famero de secuencia N - 4 * MSS [3]). En este estado, el remitente env\u00eda una retransmisi\u00f3n desde la cola rtx con un solo segmento, y n\u00fameros de secuencia N-4MSS:N-3MSS [3]. El receptor lo ve y responde con un ACK hasta N + 3 * MSS [2]. Pero el remitente rechazar\u00e1 este ACK como TCP_ACK_UNSENT_DATA porque no tiene recuerdo de haber enviado datos tan lejos [1]. Y estamos atascados. La causa ra\u00edz es el desorden de los c\u00f3digos de retorno de xmit. veth devuelve un error cuando no puede xmitir una trama. Terminamos con un evento de p\u00e9rdida como este: ------------------------------------------------- | GSO super frame 1 | GSO super frame 2 | |-----------------------------------------------| | seg | seg | seg | seg | seg | seg | seg | seg | | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | ------------------------------------------------- x ok ok [ok]| ok ok ok [x] \\\\ snd_nxt \u2019x\u2019 significa paquete perdido por veth, y \u2019ok\u2019 significa que pas\u00f3. Dado que veth tiene TSO deshabilitado en esta prueba, ve segmentos individuales. El segmento 1 est\u00e1 en la cola de retransmisi\u00f3n y ser\u00e1 reenviado. Entonces, \u00bfpor qu\u00e9 el remitente no avanz\u00f3 snd_nxt a pesar de que claramente envi\u00f3 hasta el seg 8? tcp_write_xmit() interpreta el c\u00f3digo de retorno del n\u00facleo para significar que los datos no han sido enviados en absoluto. Dado que TCP trata con supertramas GSO, no con segmentos individuales, el quid del problema es que la p\u00e9rdida de un solo segmento puede interpretarse como la p\u00e9rdida de todos. TCP solo ve el \u00faltimo c\u00f3digo de retorno para el \u00faltimo segmento de la trama GSO (entre corchetes angulares \u2019<>\u2019 en el diagrama anterior). Por supuesto, para que el problema ocurra, necesitamos una configuraci\u00f3n o un dispositivo sin un Qdisc. De lo contrario, la capa Qdisc desconecta completamente la capa de protocolo de los errores del dispositivo. Tenemos m\u00faltiples formas de solucionar esto. 1) hacer que veth no devuelva un error cuando perdi\u00f3 un paquete. Si bien esto es lo que creo que hicimos en el pasado, el problema sigue reapareciendo y es molesto de depurar. El juego de \u2019whack a mole\u2019 no es bueno. 2) arreglar los malditos c\u00f3digos de retorno Solo hablamos de NETDEV_TX_OK y NETDEV_TX_BUSY en la documentaci\u00f3n, as\u00ed que quiz\u00e1s deber\u00edamos hacer que el c\u00f3digo de retorno de ndo_start_xmit() sea un booleano. Eso es lo que m\u00e1s me gusta, pero quiz\u00e1s alg\u00fan protocolo antiguo, no realmente de red, sufrir\u00eda. 3) hacer que TCP ignore los errores No me queda del todo claro qu\u00e9 beneficio obtiene TCP de interpretar el resultado de ip_queue_xmit()? Espec\u00edficamente, una vez que la conexi\u00f3n est\u00e1 establecida y estamos enviando datos, \u00bfla p\u00e9rdida de paquetes es solo p\u00e9rdida de paquetes? 4) esta soluci\u00f3n Ignorar el rc en el caso sin Qdisc + GSO, ya que no es fiable. Ya siempre devolvemos OK en el caso TCQ_F_CAN_BYPASS. En el caso sin Qdisc, seamos un poco m\u00e1s conservadores y solo enmascaremos los errores GSO. Esta ruta es tomada por \u2019redes\u2019 no IP como CAN, MCTP, etc., as\u00ed que podr\u00edamos causar una regresi\u00f3n en algo antiguo. Esta es la m\u00e1s simple, pero \u00bftambi\u00e9n quiz\u00e1s la solu --TRUNCADO--"}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84E6C840-09B8-4381-8C73-31E14F879CCE", "versionEndExcluding": "5.10.252", "versionStartIncluding": "3.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4002FC2B-1456-4666-B240-0EBF590C4671", "versionEndExcluding": "5.15.202", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654", "versionEndExcluding": "6.1.165", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}