Security readout for executives and security teams
Plain-English summary
A local, low-privileged user may exploit a timing flaw in the Linux kernel’s MPLS handling to read sensitive memory or crash the system. The flaw occurs when MPLS label data is resized while another kernel path reads it. Business risk is highest on multi-user or shared Linux systems using MPLS.
Executive priority
Treat as a high-priority kernel maintenance issue for shared, multi-user, or MPLS-dependent Linux systems. It is less urgent for isolated systems without local untrusted users or MPLS use, but exposure should be verified rather than assumed. No active exploitation is established by the supplied evidence.
Technical view
Concurrent MPLS table resizing can leave RCU-protected forwarding or route-dump paths with mismatched platform_labels and platform_label values. This inconsistent snapshot can cause out-of-bounds memory access. The kernel correction adds a sequence counter around the paired values. CVSS 3.1 is 7.1: local access, low complexity, low privileges, with high confidentiality and availability impact.
Likely exposure
Potential exposure is limited to Linux kernels within the affected ranges identified by the CVE data, particularly systems using MPLS functionality and admitting low-privileged local users. The supplied version entries are ambiguous, so exact distribution kernels and backport status must be confirmed with each vendor. Network-only attackers are not indicated by the CVSS vector.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation requires local access and low privileges according to CVSS. Successful abuse could disclose kernel memory or disrupt availability, but the sources do not describe demonstrated exploitation, prerequisites beyond the vulnerable MPLS paths, or public exploit maturity.
Researcher notes
Relevant paths are mpls_forward and mpls_dump_routes during concurrent resize_platform_label_table activity. The record also warns that mpls_label_ok can observe the race; repeated validation inside mpls_route_add and mpls_route_del currently preserves safety and must not be removed. The sources do not supply a CWE, crash trace, reproducer, or confirmed fixed-version matrix.
Mitigation direction
- Install a vendor kernel containing the referenced MPLS sequence-counter correction or its backport.
- Prioritize shared Linux hosts where low-privileged users and MPLS functionality coexist.
- Consult distribution advisories to resolve the ambiguous affected-version information.
- Restrict unnecessary local account access while affected systems await remediation.
- Disable unused MPLS functionality only when operationally safe and vendor-supported.
Validation and detection
- Record each host’s kernel release, distribution build, and installed security update level.
- Confirm whether MPLS modules or related routing functionality are present and operationally required.
- Check vendor advisories for the correction’s backport into each distribution kernel.
- Verify patched source includes consistent sequence-counted snapshots during MPLS label-table access.
- After updating, confirm the running kernel matches the remediated package version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43042 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9efCVE reference, Linux
- https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.