Vulnerability in Linux

CVE-2026-43287

In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.002 (4.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 4.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-43287: held from 0.001 to 0.002.

EPSS over last 30 days · oldest: 0.001 · newest: 0.002 · change: +0.000

Affected products

  • Linux — versions e2f5d2ea479b9b2619965d43db70939589afe43a, 4.2, 6.1.165
  • Linux Kernel — versions 7.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-43287?
CVE-2026-43287 is a medium-severity vulnerability in Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2026-05-08.
How severe is CVE-2026-43287?
Medium severity. CVSS v3 base score is 5.5 out of 10.