CVE-2026-43208CRITICAL 9.8EPSS p37.7%
CVE-2026-43208CVE-2026-43208
Description
In the Linux kernel, the following vulnerability has been resolved:
net: do not pass flow_id to set_rps_cpu()
Blamed commit made the assumption that the RPS table for each receive
queue would have the same size, and that it would not change.
Compute flow_id in set_rps_cpu(), do not assume we can use the value
computed by get_rps_cpu(). Otherwise we risk out-of-bound access
and/or crashes.
Scoring
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 0.48% probability of exploitation · percentile 37.7% · 2026-06-18T12:00:27Z |
| Published | 2026-05-06 |
| Last modified | 2026-05-11 |
Underlying weaknesses· 1
References
1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Out-of-bounds Writecwe-787 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.