CVE-2026-43502

A flaw can leave pieces of system memory reserved after a failed high-speed network transfer. It is like repeatedly reserving parking spaces for deliveries that never arrive, then never releasing them; eventually there is no room left and the server can stop working.

This matters if you run the Linux kernel on servers or other systems where a local user has limited access. It is relevant when the system uses the RDS networking module and a user can trigger the affected high-speed send operation; it is a local risk, not an internet-reachable one by itself.

A low-privileged local attacker can repeatedly trigger the flaw to exhaust memory and disrupt the system, which warrants a red-priority response. There is no confirmed real-world exploitation, no CISA known-exploited listing, and no public exploit code, but affected systems should still be updated promptly because disruption does not require administrator access or user interaction.

Confirm the running kernel with uname -r, then identify whether the RDS module is present or in use, for example with lsmod | grep '^rds' and your application or service configuration. Prioritize hosts where untrusted or semi-trusted users can run local workloads and RDS zerocopy sends are possible.

Deploy the security kernel supplied by your Linux distribution. The published stable fix is in Linux kernel 5.10.258; upstream also provides backported fixes under commits e9aefdc5c53fe9aed108c14e3d155710a1bb14c9, 46662f7dc59475995609bf3e9d27eb36f4acf26f, 1e262db7675e27f42c3f3f47d6011855f4454f24, 21d70744e6d3bbf9293aa1ee6fba7c53ad75275e, 3abc8983b2bae3f487f77d9da5527d7d6b210d46, 14ef6fd18db2494098b21e0471bf27a1d8e9993e, 0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b, and 44b550d88b267320459d518c0743a241ab2108fa. Use the distribution package rather than manually applying an upstream commit unless you maintain your own kernel.

Plan a reboot, as a running kernel is not corrected merely by installing the package. Kernel updates can require validation of out-of-tree drivers and boot configuration, so test representative systems first if your environment uses those components.

If patching is delayed, disable or avoid the RDS module and zerocopy-send use where operationally feasible, and limit untrusted local accounts on affected hosts. Watch for unexplained, persistent memory depletion, repeated application send failures, kernel memory-pressure events, and unexpected service restarts. KEV provides no remediation deadline because this CVE is not listed there.

CVSS v3.1 is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying issue is CWE-401, an improper memory release / memory leak in rds_message_purge() during failed RDS zerocopy-send initialization after user pages are pinned but before the message is queued. An attacker needs local low-privilege access and the ability to trigger that failure path; default reachability is reported as yes.

No confirmed in-the-wild exploitation is reported, CISA KEV does not list the CVE, and no public exploit code is on record. EPSS is 0.1% at the third percentile with a flat trend; this is a prediction, not evidence of exploitation. Exploit maturity is therefore assessed as no public exploit rather than confirmed exploitation. Press attention is rising due to a roundup, not a documented incident.