Info Leak in Linux Kernel's xfrm_user Affects Security

CVE-2026-43089

What is CVE-2026-43089?

In the Linux kernel, a vulnerability in the xfrm_user interface allows for an information leak due to a one-byte padding hole in the struct xfrm_usersa_id. This padding is not zeroed out before the structure is copied to user space, which may lead to the unintended disclosure of sensitive data. The issue has been addressed in recent updates by ensuring the entire structure is zeroed out prior to variable assignment, enhancing the overall security posture of the kernel.

References