CVE-2026-43208
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
May 6, 2026
CISA due date
—
The record
In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change. Compute flow_id in set_rps_cpu(), do not assume we can use the value computed by get_rps_cpu(). Otherwise we risk out-of-bound access and/or crashes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78402 Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys… CWE-787
- CVE-2026-119777 A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. CWE-787
- CVE-2026-104065 Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw… CWE-787
- CVE-2026-104067 Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the… CWE-787
- CVE-2026-104066 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image… CWE-787
- CVE-2026-104061 Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the… CWE-787
- CVE-2026-104062 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image… CWE-787
- CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation… CWE-787