PT-2026-36454 · Linux · Linux Kernel

Oskar Kjos · Published 2026-05-01 · Updated 2026-05-13 · CVE-2026-43037

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the ip4ip6 err() function where it calls icmp send() using a cloned socket buffer (skb) containing cb[] data written as struct inet6 skb parm. The icmp send() function passes IPCB(skb2) to ip options echo(), which incorrectly interprets the cb[] region as struct inet skb parm (IPv4). Because the layouts differ, inet6 skb parm.nhoff overlaps with inet skb parm.opt.rr, resulting in a non-zero rr value. This allows ip options echo() to read an optlen value from attacker-controlled packet data and copy an arbitrary amount of bytes into dopt-> data, which is a fixed 40-byte stack buffer.

Recommendations Clear the skb2->cb[] in the ip4ip6 err() function. Implement minimal IPv4 header validation to ensure the version is 4 and the internet header length (ihl) is at least 5.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-43037

ECHO-9961-F1B5-4B85

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8 · Patch
• https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876 · Patch
• https://ubuntu.com/security/CVE-2026-43037 · Vendor Advisory
• https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43037 · Security Note
• https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39 · Patch
• https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43037 · Security Note
• https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43037 · Vendor Advisory
• https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43037 · Vendor Advisory
• https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43037 · Vendor Advisory