Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0017 5.8 —
AFFECTED Product Versions Fixed Linux 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 – — Linux 2.6.29 – 5.10.258
TIMELINE May 1 Reserved by Linux May 6 Published (CNA: Linux) Sep 8 ENRICHED — CVE-2026-43089 (Linux). Received CVSS 5.5 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_mapping() struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. Fix that up by zeroing out the whole structure before setting individual variables.
| Date | Event | Detail |
|---|---|---|
| May 1, 2026 | Reserved | Reserved by Linux |
| May 6, 2026 | Published | Published (CNA: Linux) |
| September 8, 2026 | ENRICHED | ENRICHED — CVE-2026-43089 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Authoritative record: CVE-2026-43089 at cve.org
Vendors: linux
Weaknesses: CWE-401
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43089 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
