Linux Kernel up to 6.18.18/6.19.8 rxrpc_kernel_lookup_peer allocation of resources

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.18.18/6.19.8. This impacts the function rxrpc_kernel_lookup_peer. Executing a manipulation can lead to allocation of resources. This vulnerability is tracked as CVE-2026-43463. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.18.18/6.19.8 and classified as critical. This vulnerability affects the function rxrpc_kernel_lookup_peer. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() rxrpc_kernel_lookup_peer() can also return error pointers in addition to NULL, so just checking for NULL is not sufficient. Fix this by: (1) Changing rxrpc_kernel_lookup_peer() to return -ENOMEM rather than NULL on allocation failure. (2) Making the callers in afs use IS_ERR() and PTR_ERR() to pass on the error code returned.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-43463 since 05/01/2026. There are known technical details, but no exploit is available.

Upgrading to version 6.18.19 or 6.19.9 eliminates this vulnerability. Applying the patch d55fa7cd4b19ba91b34b307d769c149e56ad0a75/54331c5dcc6d97683d7ca2788e7ef9c9505e1477/4245a79003adf30e67f8e9060915bd05cb31d142 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 6.19.7
• 6.19.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion