CVE-2026-43039 — AI Deep Analysis Summary

🚨 **Essence**: A critical bug in Linux Kernel's `ti: icssg-prueth` driver. The `emac_dispatch_skb_zc()` function allocates a new socket buffer (`skb`) but **fails to copy** data from the XDP buffer into it.…

🛡️ **Root Cause**: Two main flaws in the Zero-Copy (ZC) RX path: 1. **Missing Data Copy**: `napi_alloc_skb()` is used, but `skb_copy_to_linear_data()` is missing. Data is never transferred from XDP to `skb`. 🚫 2.…

🌍 **Affected**: Linux Kernel. Specifically, the **TI ICSSG PRUSS Ethernet driver** (`ti: icssg-prueth`). 📦 **Component**: Network subsystem, specifically the Zero-Copy RX dispatch mechanism.…

💻 **Attacker Actions**: - **Data Exfiltration**: Read uninitialized kernel heap memory via user space.…

🔓 **Exploitation Threshold**: **LOW**. - **Auth**: None required (PR:N). 🚫🔑 - **Config**: Requires the specific TI ICSSG PRUSS driver to be active and processing packets in ZC mode. 🛠️ - **UI**: None required.…

📜 **Public Exploit**: **No**. The `pocs` field is empty. 🚫💣 However, the CVSS score is **Critical (9.8)**, indicating high severity.…

🔍 **Self-Check**: 1. **Kernel Version**: Check if running a Linux kernel version containing the vulnerable `ti: icssg-prueth` driver before the fix commit. 📅 2.…

🩹 **Official Fix**: **YES**. Fixed in Linux Kernel stable branches. - **Commit 1**: `a968438d4fc17ee1dcdc3cfa490dcb5e7709cf76` (Adds missing data copy).…

🛑 **No Patch Workaround**: 1. **Disable ZC Mode**: If possible, configure the driver to use the non-ZC path (`emac_rx_packet`), which is not vulnerable. 🔄 2.…

🔥 **Urgency**: **CRITICAL**. - **CVSS**: 9.8 (High/High/High). 📈 - **Impact**: Memory leak + System corruption. 💥 - **Recommendation**: **Patch Immediately**. This is a severe memory safety issue in a network driver.…