CVE-2026-43190 | BDVDB-2026-330962 Detail

Description#

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining option length. If the last byte of the option field is not EOL/NOP (0/1), the code attempts to index op[i+1]. In the case where i + 1 == optlen, this causes an out-of-bounds read, accessing memory past the optlen boundary (either reading beyond the stack buffer _opt or the following payload).

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-06Record published in the CVE List.
2. Version 22026-10-19Most recent update recorded in the CVE List.