CyberSecBulletin
CVE-2026-43405NVD status: Modified

Linux: Use of Uninitialized Resource

Published Updated By the CyberSecBulletin desk

CVE-2026-43405 is a high-severity use of uninitialized resource vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions ee5588e2bc41acb73f6676c0520420c107cd0140, 86f7060cd638d6eb042e8ed780fb83a59ca0dcb3, 5f2806684b05bd24d05c091083b8e2517ba8ffac as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.6% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ee5588e2bc41acb73f6676c0520420c107cd0140 or 86f7060cd638d6eb042e8ed780fb83a59ca0dcb3 or 5f2806684b05bd24d05c091083b8e2517ba8ffac or b268984ae88cb0dcd7a8e8263962c748448e26e8, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.203 or 6.1.167 or 6.6.130 or 6.12.78, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxa5cbd5fc22d5043a8a76e15d75d031fe24d1f69c up to, but not including, ee5588e2bc41acb73f6676c0520420c107cd0140; a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c up to, but not including, 86f7060cd638d6eb042e8ed780fb83a59ca0dcb3; a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c up to, but not including, 5f2806684b05bd24d05c091083b8e2517ba8ffac; a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c up to, but not including, b268984ae88cb0dcd7a8e8263962c748448e26e8; a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c up to, but not including, ba0a4df8c563536857dcbf7b4dbd0f2a15f57ace; a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c up to, but not including, 08bc6173fd611ad5a40f472bf5f15b92aea0fe40; a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c up to, but not including, 770444611f047dbfd4517ec0bc1b179d40c2f346; 5.11ee5588e2bc41acb73f6676c0520420c107cd0140, 86f7060cd638d6eb042e8ed780fb83a59ca0dcb3, 5f2806684b05bd24d05c091083b8e2517ba8ffac, b268984ae88cb0dcd7a8e8263962c748448e26e8, ba0a4df8c563536857dcbf7b4dbd0f2a15f57ace, 08bc6173fd611ad5a40f472bf5f15b92aea0fe40
LinuxLinux Kernel5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.19; 6.19 up to, but not including, 6.19.9; 7.05.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in ceph_monmap_decode() This patch fixes unnecessary implicit conversions that change signedness of blob_len and num_mon in ceph_monmap_decode(). Currently blob_len and num_mon are (signed) int variables. They are used to hold values that are always non-negative and get assigned in ceph_decode_32_safe(), which is meant to assign u32 values. Both variables are subsequently used as unsigned values, and the value of num_mon is further assigned to monmap->num_mon, which is of type u32. Therefore, both variables should be of type u32. This is especially relevant for num_mon. If the value read from the incoming message is very large, it is interpreted as a negative value, and the check for num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to allocate a very large chunk of memory for monmap, which will most likely fail. In this case, an unnecessary attempt to allocate memory is performed, and -ENOMEM is returned instead of -EINVAL.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

How developers prevent this class of flaw

  • Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
  • Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
  • Avoid race conditions (CWE-362) during initialization routines.

More Use of Uninitialized Resource vulnerabilities (CWE-908)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Uninitialized Resource vulnerabilities

Spotted an error? Tell us.