SB2026050208 - Always-Incorrect Control Flow Implementation in Linux kernel core

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026050208

SB2026050208 - Always-Incorrect Control Flow Implementation in Linux kernel core

Published: May 2, 2026

Security Bulletin ID SB2026050208
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43057)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of checksum offload fallback in the IPv6 GSO fallback logic when processing tunneled IPv6 traffic with extension headers or without an inner IP protocol. A local user can send specially crafted packets to cause a denial of service.

The issue affects tunneled traffic, including cases where the inner header rather than the outer network header must be validated.


Remediation

Install update from vendor's website.

References