Answer in brief
CVE-2026-43036 records a Unknown severity vulnerability in net: use skb_header_pointer() for TCPv4 GSO frag_off check. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=cbc53e08a793b073e79f42ca33f1f3568703540d <5057502630fbc8ce468ff617ff59af275960b537 || >=cbc53e08a793b073e79f42ca33f1f3568703540d <f7a6cd508e9e825a2c69fa9e13d41ee156852f25 || >=cbc53e08a793b073e79f42ca33f1f3568703540d <cc91202fc20a44aab4c206f12a2bfe05da936051 || >=cbc53e08a793b073e79f42ca33f1f3568703540d <d970341cfa5594614c7a6634886c7688b4f5cafd || >=cbc53e08a793b073e79f42ca33f1f3568703540d <ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0 | 5057502630fbc8ce468ff617ff59af275960b537, f7a6cd508e9e825a2c69fa9e13d41ee156852f25, cc91202fc20a44aab4c206f12a2bfe05da936051, d970341cfa5594614c7a6634886c7688b4f5cafd, ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0 |
| Linux/Linuxgeneric | 4.7 | Not reported |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 21, 2026
In the Linux kernel, the following vulnerability has been resolved: net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1]. gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths. Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying. [1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407
Quoted source text, attributed separately from HOL analysis.