Reported by 1 outlet

Timeline

1. original reporting

   CVE-2026-43456: 19-Year-Old Linux Kernel Zero-Day With 99%+ Root Exploit Reliability — CISA Warns of Active Exploitation

   thecybersecguru.com · 101d ago · July 5th, 2026

   CISA has added CVE-2026-43456 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a privilege escalation vulnerability in the Linux kernel's net/bonding driver. The bug — a type confusion introduced in 2007 — remained latent for nearly 19 years because its trigger conditions require a highly specific exploit chain that no human would accidentally stumble upon: an attacker must chain exactly 329 GRE network interfaces (8 FOU + 320 plain) to force a precise 0x3ec0 byte alignment that makes the buffer overflow exploitable.

   Discovered by GMO Cybersecurity by Ierae researchers using syzkaller with AI-assisted root cause analysis, the exploit achieves over 99% success rate in under one second by: (1) bypassing KASLR via IP6GRE tunnel header functions reading the wrong memory structure; (2) triggering an arbitrary code execution path by overwriting skb_shared_info->flags to hijack the Zero-Copy callback; (3) exploiting the precise memory alignment achieved through the 329-interface chain. Affects Linux 2.6.24 through 6.12.77. Requires CAP_NET_ADMIN, which is attainable in containerized environments with unprivileged user namespaces. Patched in kernel 6.12.77 (March 2026). Google's kernelCTF awarded the researchers over $80,000.

   Recommended action: Apply latest kernel updates immediately (6.12.77+). If patching is delayed, disable unprivileged user namespaces (kernel.unprivileged_userns_clone=0) or blacklist the bonding module if not in use.