Is CVE-2026-43139 actively exploited?

No active exploitation of CVE-2026-43139 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-43139 be exploited remotely?

Yes. CVE-2026-43139 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-43139?

CVE-2026-43139 has a CVSS score of 8.6 (HIGH).

HOME VULNERABILITIESCVE-2026-43139

HIGH

CVE-2026-43139

Published: May 6, 2026· Updated: May 8, 2026

8.6

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:7.0th

Official Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: fix uninitialized saddr in xfrm6_get_saddr()

xfrm6_get_saddr() does not check the return value of

ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable

source address (returns -EADDRNOTAVAIL), saddr->in6 is left

uninitialized, but xfrm6_get_saddr() still returns 0 (success).

This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized

address in xfrm_state_find(), triggering KMSAN warning:

=====================================================

BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940

xfrm_state_find+0x2424/0xa940

xfrm_resolve_and_create_bundle+0x906/0x5a20

xfrm_lookup_with_ifid+0xcc0/0x3770

xfrm_lookup_route+0x63/0x2b0

ip_route_output_flow+0x1ce/0x270

udp_sendmsg+0x2ce1/0x3400

inet_sendmsg+0x1ef/0x2a0

__sock_sendmsg+0x278/0x3d0

__sys_sendto+0x593/0x720

__x64_sys_sendto+0x130/0x200

x64_sys_call+0x332b/0x3e70

do_syscall_64+0xd3/0xf80

entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable tmp.i.i created at:

xfrm_resolve_and_create_bundle+0x3e3/0x5a20

xfrm_lookup_with_ifid+0xcc0/0x3770

=====================================================

Fix by checking the return value of ipv6_dev_get_saddr() and propagating

the error.

NVD Source

Technical Analysis

CVE-2026-43139 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 8.6.