Security readout for executives and security teams
Plain-English summary
A Linux IPv6 networking flaw can use an uninitialized source address when address selection fails. This may cause incorrect processing or service disruption in affected systems using the XFRM/IPsec networking path. The supplied record rates it high severity, but does not establish practical exploitation or active attacks.
Executive priority
Treat as a high-priority kernel maintenance issue, especially for internet-facing or availability-sensitive Linux systems using IPv6 IPsec. Accelerate inventory and vendor patch verification, while avoiding claims of an emergency active-exploitation event because none is supported by the supplied evidence.
Technical view
xfrm6_get_saddr() incorrectly reports success after ipv6_dev_get_saddr() returns EADDRNOTAVAIL, leaving an IPv6 address uninitialized. xfrm_tmpl_resolve_one() then passes that value into xfrm_state_find(). The observed result is a KMSAN uninitialized-value warning. The fix propagates the address-selection error instead of continuing.
Likely exposure
Potential exposure exists on affected Linux kernels where IPv6 traffic traverses XFRM processing, commonly associated with IPsec. The source lists affected kernel versions but provides no distribution package mapping, configuration prerequisites, or confirmation that every listed version is exploitable in practice.
Exploitation context
The CVE is not in the supplied KEV data, and the sources provide no evidence of active exploitation or a public exploit. Although the supplied CVSS vector indicates unauthenticated network reachability, the technical description alone does not establish a reliable remote attack path.
Researcher notes
The demonstrated condition is an uninitialized IPv6 address reaching xfrm_state_find(), detected by KMSAN during UDP send processing. Sources do not document a crash, information disclosure mechanism, successful corruption, or reproducible remote trigger. The supplied CVSS impacts therefore exceed what the technical trace alone proves.
Mitigation direction
- Apply a vendor kernel update containing the referenced stable fix.
- Check distribution advisories for backported fixes and corrected package versions.
- Prioritize systems using IPv6 with XFRM or IPsec functionality.
- Follow vendor guidance if immediate kernel replacement is operationally impractical.
Validation and detection
- Inventory running kernel and distribution package versions across Linux systems.
- Confirm the installed package contains the upstream error-propagation fix or an equivalent backport.
- Identify hosts using IPv6 XFRM or IPsec networking paths.
- Review kernel diagnostics for related uninitialized-value warnings or unexplained networking failures.
- Retest affected networking workflows after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43139 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7LinuxVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4f28141786e1fe884ce42a5197ba9beed540f0eaCVE reference, Linux
- https://git.kernel.org/stable/c/6535867673bf301d52aa00593a4d1d18cc3922faCVE reference, Linux
- https://git.kernel.org/stable/c/eb2ee15290af14c60b45cf2b73f5687d1d077d9bCVE reference, Linux
- https://git.kernel.org/stable/c/719918fc88df6da023dfff370cd965151a5afd7fCVE reference, Linux
- https://git.kernel.org/stable/c/dc0abce055134cb83b0d981d31ceb20dda419787CVE reference, Linux
- https://git.kernel.org/stable/c/c7221e7bd8fc2ef38a0b27be580d9d202281306bCVE reference, Linux
- https://git.kernel.org/stable/c/3dcd1664ac15eee6a690daec7c4ffc59190406f7CVE reference, Linux
- https://git.kernel.org/stable/c/1799d8abeabc68ec05679292aaf6cba93b343c05CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.