LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43103: net: lapbether: handle NETDEV_PRE_TYPE_CHANGE

In the Linux kernel, the following vulnerability has been resolved: net: lapbether: handle NETDEV_PRE_TYPE_CHANGE lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER. Returning NOTIFY_BAD from lapbeth_device_event() makes sure bonding driver can not break this expectation.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel issue in the lapbether network driver. The driver assumes its lower network device remains Ethernet-like. The fix prevents bonding from changing the device type in a way that violates that assumption. Public sources do not state impact, CVSS, or active exploitation.

Executive priority

Handle through normal Linux kernel patch management unless internal exposure confirms lapbether and bonding usage in important systems. The absence of severity, CVSS, and exploitation evidence limits urgency, but kernel fixes should not be ignored.

Technical view

lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER. The resolved change makes lapbeth_device_event() return NOTIFY_BAD for NETDEV_PRE_TYPE_CHANGE, preventing bonding from breaking that invariant. The CVE record lists Linux kernel affected ranges and multiple stable commit references.

Likely exposure

Exposure appears limited to Linux systems with affected kernels where the lapbether driver is present and relevant network device type changes can occur, especially around bonding. The source bundle does not show affected distributions, default module status, or reachable attack paths.

Exploitation context

CISA KEV status is false in the bundle. No cited source states public exploitation, exploit availability, remote reachability, required privileges, or business impact. Treat exploitation details as unknown, not confirmed absent.

Researcher notes

The useful technical signal is the invariant protection: lapbether transmit path assumes ARPHRD_ETHER, and the patch rejects pre-type-change events. The source bundle does not document the consequence of violating that invariant, so impact analysis remains incomplete.

Mitigation direction

  • Apply vendor Linux kernel updates containing the referenced stable fixes.
  • If using custom kernels, backport the relevant lapbether NETDEV_PRE_TYPE_CHANGE fix.
  • Check distribution advisories for supported patched package versions.
  • Ask vendors for temporary guidance if patching is delayed.

Validation and detection

  • Inventory Linux kernel versions across affected systems.
  • Check whether vendor kernel changelogs include CVE-2026-43103 or the referenced commits.
  • Identify systems where the lapbether driver is loaded or available.
  • Review network bonding use on systems where lapbether is relevant.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43103 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux872254dd6b1f80cb95ee9e2e22980888533fc293, 872254dd6b1f80cb95ee9e2e22980888533fc293, 872254dd6b1f80cb95ee9e2e22980888533fc293, 872254dd6b1f80cb95ee9e2e22980888533fc293, 872254dd6b1f80cb95ee9e2e22980888533fc293, 872254dd6b1f80cb95ee9e2e22980888533fc293, 872254dd6b1f80cb95ee9e2e22980888533fc293, 872254dd6b1f80cb95ee9e2e22980888533fc293unaffected
LinuxLinux2.6.24, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.