Security readout for executives and security teams
Plain-English summary
CVE-2026-43336 is a Linux kernel crypto issue where sensitive ChaCha state could remain on the stack after use. Because that state can be reversed to recover the original state and potentially the key, the fix clears it before leaving scope. Public sources do not show active exploitation.
Executive priority
Patch in the next scheduled security update cycle, with higher priority for internet-facing Linux hosts, shared platforms, and systems protecting high-value secrets. Escalate only if your vendor reports exploitation or materially broader impact.
Technical view
The Linux kernel ChaCha implementation kept a local permuted_state variable after permutation. The upstream rationale says the permutation is invertible, so permuted_state is enough to compute the original state and key. Stable kernel commits explicitly zeroize permuted_state before scope exit. CVSS is 7.5, confidentiality impact high.
Likely exposure
Exposure is limited to Linux kernel versions carrying the affected ChaCha code and lacking the referenced stable fixes. The source bundle lists Linux as affected across multiple kernel version lines, but distro backports may change exposure. Appliance, cloud, container-host, and embedded Linux fleets should be checked through vendor kernel advisories.
Exploitation context
CVE metadata rates this as network exploitable with low complexity and no privileges. However, the provided public sources do not describe a concrete exploit path or proof of active exploitation. CISA KEV status is false in the bundle. Treat it as a high-confidence confidentiality hardening fix, not confirmed in-the-wild activity.
Researcher notes
The public record is code-fix focused. It identifies a secret lifetime issue in lib/crypto/chacha and provides stable commit references. It does not provide CWE mapping, exploit details, or full affected-version clarity. CVSS suggests serious confidentiality risk, but practical exploitability is not substantiated in the provided sources.
Mitigation direction
- Apply Linux kernel updates from your distribution or kernel vendor when available.
- Prioritize hosts handling sensitive cryptographic workloads or multi-tenant workloads.
- Confirm updates include one of the referenced stable kernel fixes.
- If no vendor package exists, follow vendor guidance for supported backports.
Validation and detection
- Inventory running Linux kernel versions across servers, appliances, and embedded systems.
- Check distro advisories or changelogs for CVE-2026-43336 or the ChaCha zeroization fix.
- Compare deployed kernel source against the referenced stable commits where applicable.
- Document exceptions where vendors state the fix was backported or the system is unaffected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43336 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e90ee961af515a484f091678ce58a4c3f7b73b02CVE reference, Linux
- https://git.kernel.org/stable/c/b416a4245f04a450c67a13e6d96056c37c5b33feCVE reference, Linux
- https://git.kernel.org/stable/c/bd62d9b44464a6c20a34a74068e7a784d0afa04aCVE reference, Linux
- https://git.kernel.org/stable/c/066c760acead1fb743bae294dbd89f479ae43b9bCVE reference, Linux
- https://git.kernel.org/stable/c/1d761e5a7340c46479fb2399598f331e4fe2c633CVE reference, Linux
- https://git.kernel.org/stable/c/1933249263c3a98df79992f61a566476e4163bccCVE reference, Linux
- https://git.kernel.org/stable/c/91999af43ca2125e3b2c18fcfc02912ada02efc3CVE reference, Linux
- https://git.kernel.org/stable/c/e5046823f8fa3677341b541a25af2fcb99a5b1e0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.