high 7.5

CVE-2026-43194 json

net: consume xmit errors of GSO frames

published 2026-05-06 6mo ago modified 2026-10-19 21d ago also EUVD-2026-27755

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same exact way, TCP GRO test stalls occasionally and the test gets killed after 10min.

These tests use veth to simulate GRO. They attach a trivial ("return XDP_PASS;") XDP program to the veth to force TSO off and NAPI on.

Digging into the failure mode we can see that the connection is completely stuck after a burst of drops. The sender's snd_nxt is at sequence number N [1], but the receiver claims to have received (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle is that senders rtx queue is not empty (let's say the block in the rtx queue is at sequence number N - 4 * MSS [3]).

In this state, sender sends a retransmission from the rtx queue with a single segment, and sequence numbers N-4*MSS:N-3*MSS [3]. Receiver sees it and responds with an ACK all the way up to N + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA because it has no recollection of ever sending data that far out [1]. And we are stuck.

The root cause is the mess of the xmit return codes. veth returns an error when it can't xmit a frame. We end up with a loss event like this:

------------------------------------------------- | GSO super frame 1 | GSO super frame 2 | |-----------------------------------------------| | seg | seg | seg | seg | seg | seg | seg | seg | | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | ------------------------------------------------- x ok ok <ok>| ok ok ok <x> \\ snd_nxt

"x" means packet lost by veth, and "ok" means it went thru. Since veth has TSO disabled in this test it sees individual segments. Segment 1 is on the retransmit queue and will be resent.

So why did the sender not advance snd_nxt even tho it clearly did send up to seg 8? tcp_write_xmit() interprets the return code from the core to mean that data has not been sent at all. Since TCP deals with GSO super frames, not individual segment the crux of the problem is that loss of a single segment can be interpreted as loss of all. TCP only sees the last return code for the last segment of the GSO frame (in <> brackets in the diagram above).

Of course for the problem to occur we need a setup or a device without a Qdisc. Otherwise Qdisc layer disconnects the protocol layer from the device errors completely.

We have multiple ways to fix this.

1) make veth not return an error when it lost a packet. While this is what I think we did in the past, the issue keeps reappearing and it's annoying to debug. The game of whack a mole is not great.

2) fix the damn return codes We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the documentation, so maybe we should make the return code from ndo_start_xmit() a boolean. I like that the most, but perhaps some ancient, not-really-networking protocol would suffer.

3) make TCP ignore the errors It is not entirely clear to me what benefit TCP gets from interpreting the result of ip_queue_xmit()? Specifically once the connection is established and we're pushing data - packet loss is just packet loss?

4) this fix Ignore the rc in the Qdisc-less+GSO case, since it's unreliable. We already always return OK in the TCQ_F_CAN_BYPASS case. In the Qdisc-less case let's be a bit more conservative and only mask the GSO errors. This path is taken by non-IP-"networks" like CAN, MCTP etc, so we could regress some ancient thing. This is the simplest, but also maybe the hackiest fix?

Similar fix has been proposed by Eric in the past but never committed because original reporter was working with an OOT driver and wasn't providing feedback (see Link).

Patch / fix

fixed in 1 distros 4 links 8

Linux Linux 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0

debian ubuntu suse opensuse

linux Debian 12 6.1.170-1
linux Debian 13 6.12.85-1
linux Debian 14 6.19.6-1

debian advisories DEBIAN-CVE-2026-43194

linux Ubuntu 22.04 LTS 5.15.0-186.196
linux Ubuntu 24.04 LTS 6.8.0-134.134
linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
linux-aws Ubuntu 24.04 LTS 6.8.0-1060.63
linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
linux-gcp Ubuntu 24.04 LTS 6.8.0-1063.69
linux-gke Ubuntu 22.04 LTS 5.15.0-1108.114
linux-gke Ubuntu 24.04 LTS 6.8.0-1058.64

ubuntu advisories UBUNTU-CVE-2026-43194

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.2
kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.1
kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.1
kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.1
kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-50.2
kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.73.2
kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.73.1
kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.73.2

suse advisories SUSE-SU-2026:22810-1 SUSE-SU-2026:22809-1 SUSE-SU-2026:22904-1 SUSE-SU-2026:22903-1 SUSE-SU-2026:3166-1 SUSE-SU-2026:22742-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.36.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.36.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.36.1

opensuse advisories openSUSE-SU-2026:21388-1

Is CVE-2026-43194 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-43194 updated 2026-11-07 cvss 5.5

kernel: net: consume xmit errors of GSO frames

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 24d ago (2026-10-16)

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-754 Improper Check for Unusual or Exceptional Conditions

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-43194
NVD CVE-2026-43194

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed