{"cve":"CVE-2026-43254","nvd":{"published":"2026-05-06T12:16:46.143","modified":"2026-06-17T10:49:15.090","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: tcp - fix packet extraction from stream\n\nWhen processing TCP stream data in ovpn_tcp_recv, we receive large\ncloned skbs from __strp_rcv that may contain multiple coalesced packets.\nThe current implementation has two bugs:\n\n1. Header offset overflow: Using pskb_pull with large offsets on\n   coalesced skbs causes skb->data - skb->head to exceed the u16 storage\n   of skb->network_header. This causes skb_reset_network_header to fail\n   on the inner decapsulated packet, resulting in packet drops.\n\n2. Unaligned protocol headers: Extracting packets from arbitrary\n   positions within the coalesced TCP stream provides no alignment\n   guarantees for the packet data causing performance penalties on\n   architectures without efficient unaligned access. Additionally,\n   openvpn's 2-byte length prefix on TCP packets causes the subsequent\n   4-byte opcode and packet ID fields to be inherently misaligned.\n\nFix both issues by allocating a new skb for each openvpn packet and\nusing skb_copy_bits to extract only the packet content into the new\nbuffer, skipping the 2-byte length prefix. Also, check the length before\ninvoking the function that performs the allocation to avoid creating an\ninvalid skb.\n\nIf the packet has to be forwarded to userspace the 2-byte prefix can be\npushed to the head safely, without misalignment.\n\nAs a side effect, this approach also avoids the expensive linearization\nthat pskb_pull triggers on cloned skbs with page fragments. In testing,\nthis resulted in TCP throughput improvements of up to 74%.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-190"],"references":["https://git.kernel.org/stable/c/0315bec883c67fa1413c61e504a28dc5bd02eb37","https://git.kernel.org/stable/c/7dba6cd7fb168d7615194a631c9c100c1c224131","https://git.kernel.org/stable/c/d4f687fbbce45b5e88438e89b5e26c0c15847992"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:33:55.586217763+00:00"},"epss":{"cve":"CVE-2026-43254","score":0.00451,"percentile":0.39196,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}