CVE-2026-43039 Vulnerability in the ICSSG-PRUETH network driver within the Linux kernel

Impacted Products

• CubeCOS

Introduction

This advisory covers CVE-2026-43039

CubeCOS is not affected by this vulnerability.

A critical vulnerability has been identified in the Texas Instruments ICSSG-PRUETH network driver within the Linux kernel. This flaw involves the incorrect handling of Zero-Copy (ZC) receive dispatch, potentially leading to kernel memory disclosure or system instability. CubeCOS is not affected by this vulnerability. While the CVE carries a high severity rating for specific embedded hardware, the architectural design and software composition of CubeCOS provide a natural immunity.

Description

The vulnerability, tracked as CVE-2026-43039, resides in the emac_dispatch_skb_zc() function of the icssg-prueth driver. It occurs when the driver fails to properly initialize or copy packet data into socket buffers, allowing uninitialized kernel heap memory to be processed by the network stack. This can lead to the leakage of sensitive kernel information or memory corruption.

Risk Assessment and Exposure

The risk to CubeCOS users is zero, based on the following technical verification:

• Absence of Driver Modules: The affected driver, icssg-prueth, is not included in the CubeCOS kernel distribution. Investigation of the filesystem confirms that no such driver exists within the directory: /usr/lib/modules/6.12.74-1.el9.x86_64

• No Runtime Presence: Runtime analysis of the CubeCOS environment confirms that the prueth module is not loaded, nor is the underlying hardware (TI Sitara industrial processors) supported by the standard CubeCOS hardware abstraction layer.
• Hardware Incompatibility: The vulnerable code path is hardware-specific to Texas Instruments ICSSG-PRU Ethernet controllers, which are not utilized in the production server environments where CubeCOS is deployed.

Customer Actions Required

No immediate action is required by administrators. Because the vulnerable driver is neither present nor loaded, the attack surface does not exist within CubeCOS.

Although the system is not vulnerable, CubeCOS maintains a proactive security posture.

• Resolution: Future maintenance releases of CubeCOS will continue to track upstream kernel security patches.
• Fix: Any future kernel transitions will ensure that if the TI drivers are ever introduced, they will include the fix for the emac_dispatch_skb_zc() function to prevent regression.

References

List

• https://nvd.nist.gov/vuln/detail/CVE-2026-43039
• https://access.redhat.com/security/cve/cve-2026-43039

Change Log

Contact Us