CVE-2026-43244

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kcm: fix zero-frag skb in frag_list on partial sendmsg error

Syzkaller reported a warning in kcm_write_msgs() when processing a

message with a zero-fragment skb in the frag_list.

When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,

it allocates a new skb (tskb) and links it into the frag_list before

copying data. If the copy subsequently fails (e.g. -EFAULT from

user memory), tskb remains in the frag_list with zero fragments:

head skb (msg being assembled, NOT yet in sk_write_queue)

+-----------+

| frags[17] | (MAX_SKB_FRAGS, all filled with data)

| frag_list-+--> tskb

+-----------+ +----------+

| frags[0] | (empty! copy failed before filling)

+----------+

For SOCK_SEQPACKET with partial data already copied, the error path

saves this message via partial_message for later completion. For

SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References