CVE-2026-43036
Description
In the Linux kernel, the following vulnerability has been resolved: net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1]. gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths. Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying. [1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407
How to fix
- linux linux_kernel6.12.81, 6.18.22, 6.19.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.7 ≤ v < 6.12.81, 6.13 ≤ v < 6.18.22, 6.19 ≤ v < 6.19.12, 7.0 | 6.12.81, 6.18.22, 6.19.12 |
| microsoft azl3_kernel_6.6.134.1-2 | No range specified | — |
| microsoft azl3_kernel_6.6.143.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.145.2-1 | No range specified | — |
| microsoft azl3_kernel_6.6.157.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.137.1-2 | No range specified | — |
| microsoft azl3_kernel_6.6.138.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.139.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.141.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.144.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.150.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.152.1-1 | No range specified | — |
| microsoft azl3_kernel_6.6.159.1-1 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.