CVE-2026-43445

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

e1000/e1000e: Fix leak in DMA error cleanup

If an error is encountered while mapping TX buffers, the driver should

unmap any buffers already mapped for that skb.

Because count is incremented after a successful mapping, it will always

match the correct number of unmappings needed when dma_error is reached.

Decrementing count before the while loop in dma_error causes an

off-by-one error. If any mapping was successful before an unsuccessful

mapping, exactly one DMA mapping would leak.

In these commits, a faulty while condition caused an infinite loop in

dma_error:

Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e

driver")

Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver")

Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of

unsigned in *_tx_map()") fixed the infinite loop, but introduced the

off-by-one error.

This issue may still exist in the igbvf driver, b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References