CyberSecBulletin
CVE-2026-43194NVD status: Modified

Linux: Improper Check for Unusual or Exceptional Conditions

Published Updated By the CyberSecBulletin desk

CVE-2026-43194 is a high-severity improper check for unusual or exceptional conditions vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions ae3f627b45fbc3c776a4e484696f3cad7cbb4eca, 0c9de092ef8c50a7ee9612811566f0aa81d8d7b6, 56bd32c0edca34041a5c215887fcf562fae2e2db as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.53% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ae3f627b45fbc3c776a4e484696f3cad7cbb4eca or 0c9de092ef8c50a7ee9612811566f0aa81d8d7b6 or 56bd32c0edca34041a5c215887fcf562fae2e2db or 9ac6aebef4b4bfc5ed408b0b65645981574bc780, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.252 or 5.15.202 or 6.1.165 or 6.6.128, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, ae3f627b45fbc3c776a4e484696f3cad7cbb4eca; 1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, 0c9de092ef8c50a7ee9612811566f0aa81d8d7b6; 1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, 56bd32c0edca34041a5c215887fcf562fae2e2db; 1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, 9ac6aebef4b4bfc5ed408b0b65645981574bc780; 1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5; 1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, 4cb163e9efcac4cd35c3043e097f25081a5c015c; 1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, c86901d22c89a6bf4e2f013e948aaabc60869893; 1f59533f9ca5634e7b8914252e48aee9d9cbe501 up to, but not including, 7aa767d0d3d04e50ae94e770db7db8197f666970; and 1 more rangesae3f627b45fbc3c776a4e484696f3cad7cbb4eca, 0c9de092ef8c50a7ee9612811566f0aa81d8d7b6, 56bd32c0edca34041a5c215887fcf562fae2e2db, 9ac6aebef4b4bfc5ed408b0b65645981574bc780, ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5, 4cb163e9efcac4cd35c3043e097f25081a5c015c
LinuxLinux Kernel3.18 up to, but not including, 5.10.252; 5.11 up to, but not including, 5.15.202; 5.16 up to, but not including, 6.1.165; 6.2 up to, but not including, 6.6.128; 6.7 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; 6.19 up to, but not including, 6.19.6; 7.05.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: consume xmit errors of GSO frames udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same exact way, TCP GRO test stalls occasionally and the test gets killed after 10min. These tests use veth to simulate GRO. They attach a trivial ("return XDP_PASS;") XDP program to the veth to force TSO off and NAPI on. Digging into the failure mode we can see that the connection is completely stuck after a burst of drops. The sender's snd_nxt is at sequence number N [1], but the receiver claims to have received (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle is that senders rtx queue is not empty (let's say the block in the rtx queue is at sequence number N - 4 * MSS [3]). In this state, sender sends a retransmission from the rtx queue with a single segment, and sequence numbers N-4*MSS:N-3*MSS [3]. Receiver sees it and responds with an ACK all the way up to N + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA because it has no recollection of ever sending data that far out [1]. And we are stuck. The root cause is the mess of the xmit return codes. veth returns an error when it can't xmit a frame. We end up with a loss event like this: ------------------------------------------------- | GSO super frame 1 | GSO super frame 2 | |-----------------------------------------------| | seg | seg | seg | seg | seg | seg | seg | seg | | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | ------------------------------------------------- x ok ok <ok>| ok ok ok <x> \\ snd_nxt "x" means packet lost by veth, and "ok" means it went thru. Since veth has TSO disabled in this test it sees individual segments. Segment 1 is on the retransmit queue and will be resent. So why did the sender not advance snd_nxt even tho it clearly did send up to seg 8? tcp_write_xmit() interprets the return code from the core to mean that data has not been sent at all. Since TCP deals with GSO super frames, not individual segment the crux of the problem is that loss of a single segment can be interpreted as loss of all. TCP only sees the last return code for the last segment of the GSO frame (in <> brackets in the diagram above). Of course for the problem to occur we need a setup or a device without a Qdisc. Otherwise Qdisc layer disconnects the protocol layer from the device errors completely. We have multiple ways to fix this. 1) make veth not return an error when it lost a packet. While this is what I think we did in the past, the issue keeps reappearing and it's annoying to debug. The game of whack a mole is not great. 2) fix the damn return codes We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the documentation, so maybe we should make the return code from ndo_start_xmit() a boolean. I like that the most, but perhaps some ancient, not-really-networking protocol would suffer. 3) make TCP ignore the errors It is not entirely clear to me what benefit TCP gets from interpreting the result of ip_queue_xmit()? Specifically once the connection is established and we're pushing data - packet loss is just packet loss? 4) this fix Ignore the rc in the Qdisc-less+GSO case, since it's unreliable. We already always return OK in the TCQ_F_CAN_BYPASS case. In the Qdisc-less case let's be a bit more conservative and only mask the GSO errors. This path is taken by non-IP-"networks" like CAN, MCTP etc, so we could regress some ancient thing. This is the simplest, but also maybe the hackiest fix? Similar fix has been proposed by Eric in the past but never committed because original reporter was working with an OOT driver and wasn't providing feedback (see Link).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions back to the user (CWE-209, CWE-248).
  • Check the results of all functions that return a value and verify that the value is expected.
  • If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).

More Improper Check for Unusual or Exceptional Conditions vulnerabilities (CWE-754)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Check for Unusual or Exceptional Conditions vulnerabilities

Spotted an error? Tell us.