CVE-2026-43035

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43035
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43035.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-43035
Downstream
Related
Published
2026-05-01T14:15:33.922Z
Modified
2026-07-04T18:29:24.047810180Z
Summary
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
Details

In the Linux kernel, the following vulnerability has been resolved:

net: sched: clsapi: fix tcchainfillnode to initialize tcm_info to zero to prevent an info-leak

When building netlink messages, tcchainfillnode() never initializes the tcminfo field of struct tcmsg. Since the allocation is not zeroed, kernel heap memory is leaked to userspace through this 4-byte field.

The fix simply zeroes tcm_info alongside the other fields that are already initialized.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43035.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
32a4f5ecd7381f30ae3bb36dea77a150ba68af2e
Fixed
903c3405cfcc7700260e456ab66a5867586c9e69
Fixed
71a3eda7e850ae844cb8993065f4e410c11a46ce
Fixed
4ae5d23f51fb91d7d1140c6f1ba77ab0756054c3
Fixed
e35f5195cd44ff4053fbc5d71ea97681728a0099
Fixed
d6db08484c6cb3d4ad696246f9d288eceba2a078
Fixed
906997ea3766c24fbbf9cc4bf17c047315bbd138
Fixed
1091b3c174441a52fdbb92e2fe00338f9371a91c
Fixed
e6e3eb5ee89ac4c163d46429391c889a1bb5e404

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43035.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.19.0
Fixed
5.10.253
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.203
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.168
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.134
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.81
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.22
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.12

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43035.json"