Linux Kernel up to 6.19.11 NAPI Page emac_dispatch_skb_zc uninitialized pointer

Summaryinfo

A vulnerability identified as critical has been detected in Linux Kernel up to 6.19.11. This issue affects the function emac_dispatch_skb_zc of the component NAPI Page. Performing a manipulation results in uninitialized pointer. This vulnerability is known as CVE-2026-43039. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.19.11. This affects the function emac_dispatch_skb_zc of the component NAPI Page. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. CWE is classifying the issue as CWE-824. The product accesses or uses a pointer that has not been initialized. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch emac_dispatch_skb_zc() allocates a new skb via napi_alloc_skb() but never copies the packet data from the XDP buffer into it. The skb is passed up the stack containing uninitialized heap memory instead of the actual received packet, leaking kernel heap contents to userspace. Copy the received packet data from the XDP buffer into the skb using skb_copy_to_linear_data(). Additionally, remove the skb_mark_for_recycle() call since the skb is backed by the NAPI page frag allocator, not page_pool. Marking a non-page_pool skb for recycle causes the free path to return pages to a page_pool that does not own them, corrupting page_pool state. The non-ZC path (emac_rx_packet) does not have these issues because it uses napi_build_skb() to wrap the existing page_pool page directly, requiring no copy, and correctly marks for recycle since the page comes from page_pool_dev_alloc_pages().

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-43039 since 05/01/2026. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/01/2026).

Upgrading to version 6.19.12 eliminates this vulnerability. Applying the patch a968438d4fc17ee1dcdc3cfa490dcb5e7709cf76/5597dd284ff8c556c0b00f6a34473677426e3f81 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 6.19.7
• 6.19.8
• 6.19.9
• 6.19.10
• 6.19.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion