CVE-2026-43284

Think of the kernel as the part of your computer that securely handles encrypted network traffic. This bug happens while decrypting certain encrypted packets (ESP) and could accidentally decrypt “from the wrong kind of memory,” letting a local attacker with limited access read or alter sensitive data inside those packets. In simple terms: it’s like reading an encrypted document, but the pages being used are shared with someone else, so the contents can leak or be changed.

This matters if you run affected Linux distributions on machines where an attacker can get local access (for example, any situation with untrusted or shared accounts on the host). The issue requires local access with low privileges and involves ESP packet decryption inside the kernel, so it’s primarily a risk for multi-user environments. Reachability from the internet is not the main concern here; it’s mainly about whether a local attacker can trigger the vulnerable ESP decryption path on your system.

This is rated AMBER because the bug has a high chance to be reachable in practice when the right local conditions are met and it affects sensitive packet decryption. There’s no public exploit code on record and it is not listed in CISA KEV, but press attention is rising and patches are available—so plan to remediate promptly, especially on multi-user systems.

Confirm exposure

• For each affected server/container host, check the running kernel: uname -r.
• If you are using a virtualized/cloud image, also verify the underlying host kernel and any exposed nodes, not just application containers.

Determine patched status

• The fix is in the Linux kernel and is available via distribution kernel updates.
• Use your distro’s “security updates” or kernel package version mapping to ensure the running kernel includes one of the following fixed commits:
  • a6cb440f274a22456ef3e86b457344f1678f38f9
  • ab8b995323e5237041472d07e5055f5f7dcdf15b
  • fe785bb3a8096dffcc4048a85cd0c83337eeecad
  • 5d55c7336f8032d434adcc5fab987ccc93a44aec
  • 8253aab4659ca16116b522203c2a6b18dccacea7
  • 50ed1e7873100f77abad20fd31c51029bc49cd03
  • b54edf1e9a3fd3491bdcb82a21f8d21315271e0d
  • 71a1d9d985d26716f74d21f18ee8cac821b06e97
  • 52646cbd00e765a6db9c3afe9535f26218276034
  • f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4
  • 5.10.255 (also listed as a fixed version)

Upgrade / remediation

• Apply the distribution’s kernel security update and reboot so the fixed kernel is actually running.
• If your organization uses multiple kernel branches (for example, older long-term kernels), ensure you follow the vendor’s branch-appropriate fixed build.

Temporary workaround (if patching is delayed)

• No concrete workaround details were provided in the findings beyond the note that workarounds exist; check your distribution’s security advisory for the specific workaround steps.

What to monitor

• After upgrading, monitor that kernel updates completed successfully (running version matches the updated kernel).
• Watch for ESP/IPsec-related traffic errors or kernel networking log changes after the reboot, and confirm VPN/IPsec services remain functional.

Severity is HIGH (CVSS 8.8). The vulnerability is CWE-123 (improper handling of a condition/constraint), affecting Linux kernel xfrm ESP decryption. Mechanism: ESP input could take a “no copy” fast path and decrypt in place when skb fragments are shared (externally backed), which can lead to unauthorized access or modification of sensitive packet data. Findings indicate exploitation is not confirmed in CISA KEV and there is no public exploit code on record; however, the likelihood prediction is very high and rising. KEV is not listed for this CVE, and there’s patch coverage via multiple fixed kernel commits listed above; treat remediation as especially relevant for systems where low-privilege local attackers can exist and where the ESP decryption path can be triggered.