CVE-2026-43445: Linux kernel · e1000/e1000e: Fix leak in DMA error cleanup
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in fa5ba9867a55e640df0dc79bf0199770fb043f03 : update Linux kernel when convenient.
Data as of 6 Nov 2026, 16:04 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in fa5ba9867a55e640df0dc79bf0199770fb043f03, e94eaef11142b01f77bf8ba4d0b59720b7858109, 519051c711dfd239ef6e4b28878efee400a035f9 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 8 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
Description
In the Linux kernel, the following vulnerability has been resolved: e1000/e1000e: Fix leak in DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak. In these commits, a faulty while condition caused an infinite loop in dma_error: Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver") Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver") Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error. This issue may still exist in the igbvf driver, but I did not address it in this patch.
References
- git.kernel.org/stable/c/7eaeb778bfaa3b2a804f89321c234d59c74569db (opens in a new tab)
- git.kernel.org/stable/c/0606c24a745bafd1be5d66c48361638cd9cad74b (opens in a new tab)
- git.kernel.org/stable/c/519051c711dfd239ef6e4b28878efee400a035f9 (opens in a new tab)
- git.kernel.org/stable/c/0a1fc25deabab4efce64610e3c449485c4fa8f5f (opens in a new tab)
- git.kernel.org/stable/c/fa5ba9867a55e640df0dc79bf0199770fb043f03 (opens in a new tab)
- git.kernel.org/stable/c/30e87ade8d678c25a8546cf38c0b498fa5cb27d3 (opens in a new tab)
- git.kernel.org/stable/c/10b5e65959e955a1c8894e0a5413944b5a70204a (opens in a new tab)
- git.kernel.org/stable/c/e94eaef11142b01f77bf8ba4d0b59720b7858109 (opens in a new tab)