CVE-2026-43190

What it actually does

CVE-2026-43190 is an out-of-bounds read in the Linux kernel netfilter TCP MSS option parsing logic. When the xt_tcpmss parser examines TCP options, it can read op[i+1] without first confirming that a second byte remains in the option buffer. A malformed TCP packet whose final TCP option byte is neither End-of-Option-List nor NOP can cause the kernel to read past the validated option boundary. In practical terms, exploitation may crash the kernel or affected networking path and may expose a small amount of adjacent memory, depending on kernel configuration, logging, and memory-safety instrumentation. The issue is remotely reachable where traffic is processed by affected netfilter TCP MSS matching or related rules, and it requires no authentication or user interaction.

Why it matters to the business

Systems using affected Linux kernels as servers, routers, gateways, firewalls, load balancers, container hosts, or network appliances may be susceptible to remote denial of service from crafted TCP traffic. The most likely operational consequence is service interruption caused by a kernel panic, networking failure, or device reboot. Because Linux kernels are widely embedded in infrastructure and downstream products, exposure may exist not only on general-purpose servers but also in appliances and platforms that rely on netfilter. The EPSS score is currently low and no known exploitation or CISA KEV listing is reported, but the flaw is network-reachable, low-complexity, and has high availability impact, so internet-facing packet-filtering systems should still be prioritized.

How an attack unfolds

An attacker first identifies a Linux-based host or network device that processes inbound or forwarded TCP packets through netfilter rules involving TCP MSS parsing. The attacker then sends specially crafted TCP packets with a malformed TCP options field where the last option byte is not EOL or NOP and no additional option-length byte remains. When the vulnerable xt_tcpmss parser evaluates the packet, it attempts to read beyond the remaining TCP option buffer. Depending on memory layout and kernel hardening, this can result in an invalid memory access, kernel warning, KASAN report, crash, or panic. Exploitation does not require credentials, application-layer access, or user interaction; the vulnerable condition is triggered during packet processing.

How to fix it

Apply the Linux kernel update containing the netfilter xt_tcpmss bounds-check fix from the relevant Linux distribution, appliance vendor, cloud image provider, or kernel maintainer. No exact fixed package versions were provided in the input, so track vendor advisories for CVE-2026-43190 and upgrade to the first fixed kernel release or later. Reboot systems after installing the corrected kernel, because kernel updates are not fully effective until the running kernel is replaced. Where immediate patching is not possible, reduce exposure by removing unnecessary netfilter rules that use TCP MSS matching or manipulation, unloading or preventing use of the xt_tcpmss module where operationally safe, filtering malformed TCP packets at an upstream device, and limiting untrusted traffic to systems that act as packet filters or routers.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel version matches a vendor-fixed release, not merely that the package is installed on disk. On Linux systems, compare uname -a or uname -r with the distribution security advisory and package changelog. Check whether xt_tcpmss is present or loaded using module inventory tools such as lsmod and modinfo, and review iptables, ip6tables, nftables, or firewall-management output for rules involving TCP MSS matching or manipulation. Confirm that affected systems were rebooted after patching. For exposure validation, identify internet-facing or untrusted-network-facing hosts that route, bridge, NAT, or filter TCP traffic and run affected kernels.

Typical attack path

1. Locate a Linux system, firewall, router, gateway, or appliance that accepts or forwards TCP traffic and uses affected netfilter TCP MSS processing.
2. Craft TCP packets with malformed TCP options where the final option byte is neither 0x00 nor 0x01 and the expected option-length byte is absent.
3. Send the crafted packets to or through the affected system so they are evaluated by the vulnerable netfilter path.
4. Trigger an out-of-bounds read in the kernel TCP MSS option parser.
5. Cause a kernel fault, panic, networking disruption, or possible limited memory exposure depending on runtime conditions.

How to detect it

Detection should focus on evidence of kernel faults and malformed TCP traffic reaching systems that use netfilter TCP MSS processing. Review kernel logs, system journals, crash dumps, appliance event logs, and centralized logging for kernel oops, panic, KASAN, or out-of-bounds read messages referencing xt_tcpmss, TCPMSS, tcpmss, or netfilter. Correlate those events with inbound or forwarded TCP traffic immediately before the crash or reboot. Network telemetry should be examined for TCP packets with malformed option fields, especially packets where the last TCP option byte is neither 0x00 nor 0x01 and no valid option-length byte follows. If packet captures are available, inspect traffic to exposed firewalls, routers, VPN gateways, NAT devices, and Linux hosts that apply iptables, ip6tables, nftables, or firewall-management rules. Also review reboot history, watchdog resets, kernel crash dumps, and availability-monitoring alerts for unexplained outages on systems that process untrusted TCP traffic. There are no public threat actors or known exploitation campaigns reported in the provided input.

• xt_tcpmss
• TCPMSS
• tcpmss
• netfilter
• BUG: KASAN
• slab-out-of-bounds
• out-of-bounds read
• kernel BUG
• kernel panic
• Oops:
• general protection fault
• net/netfilter/xt_tcpmss.c
• -m tcpmss
• --mss
• --clamp-mss-to-pmtu

What your security team should do

• Prioritize patching internet-facing Linux firewalls, routers, gateways, load balancers, VPN concentrators, Kubernetes/container hosts, and network appliances that process untrusted TCP traffic.
• Inventory systems running Linux kernels with netfilter enabled, especially those with xt_tcpmss loaded or firewall rules involving TCP MSS processing.
• Monitor vendor advisories for exact fixed kernel versions and update to a fixed kernel as soon as available; reboot after installation.
• If patching must be delayed, remove unnecessary TCP MSS netfilter rules or disable the xt_tcpmss module where this does not break routing, MTU, VPN, or firewall functionality.
• Enable enhanced monitoring for kernel oops, panic, watchdog reset, spontaneous reboot, and KASAN-style out-of-bounds read messages on exposed systems.
• Review perimeter packet-capture, firewall, and IDS telemetry for malformed TCP options targeting systems that perform packet filtering or forwarding.
• Because EPSS is low and no exploitation is currently reported, balance urgency against operational risk, but do not defer remediation on critical network choke points where a kernel crash would cause outage.