Security readout for executives and security teams
Plain-English summary
A flaw in Linux NCSI network-management handling can leak kernel memory when certain invalid or unresolvable packets trigger error paths. Repeated triggering could consume memory and disrupt system availability. The supplied assessment rates it CVSS 7.5 (high), with no stated confidentiality or integrity impact.
Executive priority
Treat as a high-priority availability issue for NCSI-enabled, business-critical Linux systems. Accelerate vendor-supported kernel updates, but avoid assuming universal Linux exposure. Current evidence does not establish active exploitation, so prioritize according to confirmed NCSI use, vendor applicability, and operational impact.
Technical view
The NCSI receive and asynchronous-event handlers return early without freeing the received socket buffer in several error conditions. These include invalid AEN packets and failures to resolve the NCSI device, response handler, or request. Accumulated leaked buffers can exhaust memory, producing an availability impact.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel where NCSI functionality is present and processes relevant traffic. The supplied version data is ambiguous and includes commit identifiers, so vulnerability managers should confirm applicability against their distribution's advisory and kernel package rather than relying only on upstream version numbers.
Exploitation context
The supplied CVSS vector describes network-reachable, low-complexity triggering without privileges or user interaction. However, the bundle provides no proof of exploitation, exploit availability, or confirmed attack path in specific deployments. The CVE is not listed as KEV in the supplied data.
Researcher notes
The defect is an skb lifetime error across multiple early-return branches in ncsi_aen_handler() and ncsi_rcv_rsp(). The source bundle provides eight stable-kernel commit references but no CWE, reproducer, affected configuration details, or exploitation evidence. Distribution backports may make kernel-version-only checks unreliable.
Mitigation direction
- Update to a vendor-supported kernel package containing the applicable upstream stable fix.
- Check Linux distribution advisories for affected package versions and backported patches.
- Prioritize NCSI-enabled infrastructure and systems where availability is operationally critical.
- Monitor memory pressure until remediation is deployed.
Validation and detection
- Inventory kernel versions and determine which systems use NCSI functionality.
- Confirm the installed kernel package includes the relevant stable fix or backport.
- Review kernel and system monitoring for unexplained memory growth or pressure.
- After updating, verify the new kernel is running following any required reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43373 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9891d7f4f1ede473c54b49776ae07755083eef06CVE reference, Linux
- https://git.kernel.org/stable/c/fef5aa6e3bcf3c8053307642663a63b7362d7552CVE reference, Linux
- https://git.kernel.org/stable/c/81d6aee32f8f7bbc175c05dbf61f4430bfb88c4aCVE reference, Linux
- https://git.kernel.org/stable/c/59962588197863d0d746879f193905c0c6b3df49CVE reference, Linux
- https://git.kernel.org/stable/c/553366c271479c0d571dd1bb5d1bcde4747fb82eCVE reference, Linux
- https://git.kernel.org/stable/c/b70c4e5e711931cdd56e6e905737b72f1e649189CVE reference, Linux
- https://git.kernel.org/stable/c/87138dde2d6937b12b967f28fe598a7d59000ae4CVE reference, Linux
- https://git.kernel.org/stable/c/5c3398a54266541610c8d0a7082e654e9ff3e259CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.