{"id":"CVE-2026-57043","kind":"vulnerability","aliases":["CVE-2026-57043"],"related":[],"title":"Linux TIPC virtio driver: probe failure cleanup corrupts memory, enabling local privilege escalation","description":"In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"A logic error in the tipc_dev_probe function of the TIPC virtio driver causes an off-by-one cleanup loop on probe failure that corrupts memory. An attacker with local access can use this to escalate privileges to System level.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","linux-kernel","tipc","virtio"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:18+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","triaged_at":"2026-11-10T20:52:06+00:00","updated_at":"2026-11-10T20:52:06+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:52:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux TIPC virtio driver: probe failure cleanup corrupts memory, enabling local privilege escalation","impact":"high","summary":"A logic error in the tipc_dev_probe function of the TIPC virtio driver causes an off-by-one cleanup loop on probe failure that corrupts memory. An attacker with local access can use this to escalate privileges to System level.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","tipc","virtio","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains System-level privileges through memory corruption","analyst_note":"Identify affected kernel or Android versions and the fixed commit from the NVD entry and the vendor bulletin; the sources give no ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The flaw is in the TIPC virtio device driver, which is used when TIPC transport runs over virtio devices. Only systems with that driver in use are relevant. The sources do not say which kernel or Android versions are affected, and the report does not state which systems can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4559,"output_tokens":472,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-57043':16A,19A 'access':59B 'android':20B 'attack':56B 'caus':41B 'cleanup':7A,47B,91C 'corrupt':8A,53B,83C 'could':102C 'cve':14A,17A 'dev':33B,71C 'dev.c':76C 'driver':4A,40B 'due':96C 'enabl':10A 'error':29B,100C 'escal':13A,64B,106C 'execut':111C 'exploit':120C 'failur':6A,51B,95C 'function':35B 'infrastructur':21B 'interact':115C 'kernel':24B 'lead':103C 'level':68B 'linux':1A,23B 'linux-kernel':22B 'local':11A,58B,105C 'logic':28B,99C 'loop':48B,92C 'memori':9A,54B,84C 'need':113C,118C 'off-by-on':43B,87C 'one':46B,90C 'possibl':80C 'privileg':12A,65B,108C,112C 'probe':5A,34B,50B,72C,94C 'system':67B,110C 'tipc':2A,25B,32B,38B,70C,74C 'use':61B 'user':114C 'via':85C 'virtio':3A,26B,39B,75C 'way':81C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the TIPC virtio device driver, which is used when TIPC transport runs over virtio devices. Only systems with that driver in use are relevant. The sources do not say which kernel or Android versions are affected, and the report does not state which systems can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","linuxkernel","tipc","unknown","virtio"],"campaign_type":null,"search_a":"'-2026':15A,18A '-57043':16A,19A 'cleanup':7A 'corrupt':8A 'cve':14A,17A 'driver':4A 'enabl':10A 'escal':13A 'failur':6A 'linux':1A 'local':11A 'memori':9A 'privileg':12A 'probe':5A 'tipc':2A 'virtio':3A","search_b":"'access':59B 'android':20B 'attack':56B 'caus':41B 'cleanup':47B 'corrupt':53B 'dev':33B 'driver':40B 'error':29B 'escal':64B 'failur':51B 'function':35B 'infrastructur':21B 'kernel':24B 'level':68B 'linux':23B 'linux-kernel':22B 'local':58B 'logic':28B 'loop':48B 'memori':54B 'off-by-on':43B 'one':46B 'privileg':65B 'probe':34B,50B 'system':67B 'tipc':25B,32B,38B 'use':61B 'virtio':26B,39B","search_c":"'cleanup':91C 'corrupt':83C 'could':102C 'dev':71C 'dev.c':76C 'due':96C 'error':100C 'escal':106C 'execut':111C 'exploit':120C 'failur':95C 'interact':115C 'lead':103C 'local':105C 'logic':99C 'loop':92C 'memori':84C 'need':113C,118C 'off-by-on':87C 'one':90C 'possibl':80C 'privileg':108C,112C 'probe':72C,94C 'system':110C 'tipc':70C,74C 'user':114C 'via':85C 'virtio':75C 'way':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57043","severity":null,"published_at":"2026-11-10T20:19:18+00:00","modified_at":"2026-11-10T20:19:18+00:00","first_seen_at":"2026-11-10T20:46:08+00:00","fetched_at":"2026-11-10T20:46:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}