Linux Kernel kernel performance subsystem Null Pointer Dereference Rated 7.5 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-43099

Key Details

CVE	CVE-2026-43099
CVSS Score / Version	7.5 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high.
Affected products	Linux Kernel and Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Classified as	CWE-476 (NULL Pointer Dereference)
Exploitation prediction (EPSS)	0.72% probability of exploitation in the next 30 days (53% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Siemens

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Subsystems	Controllers & Field I/O, OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the

IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing

this error pointer to dev_hold() will cause a kernel crash with

null-ptr-deref.

Instead, silently discard the request. RFC 8335 does not appear to

define a specific response for the case where an IPv6 interface

identifier is syntactically valid but the implementation cannot perform

the lookup at runtime, and silently dropping the request may safer than

misreporting "No Such Interface". (NVD)

Monitor Linux's and Siemens's web pages for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-43099
CVE	https://www.cve.org/CVERecord?id=CVE-2026-43099

Source

Reference

NVD

CVE