PT-2026-36455 · Linux · Linux Kernel

Sashiko Ai-Review · Published 2026-05-01 · Updated 2026-05-13 · CVE-2026-43038

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the ip6 err gen icmpv6 unreach() function fails to clear the skb2->cb[] array. When an outer IPv4 ICMP error packet is cloned into skb2 and passed to icmp6 send(), the system interprets IPv4 inet skb parm as inet6 skb parm. Specifically, the CIPSO offset in inet skb parm.opt overlaps with dsthao in inet6 skb parm at offset 18. An attacker can send a forged ICMPv4 error with a CIPSO IP option to set a non-zero dsthao offset. This causes mip6 addr swap() to use ipv6 find tlv() to scan the inner attacker-controlled IPv6 packet, potentially returning a fake TLV without verifying if the remaining packet length can accommodate the 18-byte struct ipv6 destopt hao. This may lead to a 16-byte swap that extends beyond the packet data into skb shared info.

Recommendations Apply the patch that clears the cb array in the ip6 err gen icmpv6 unreach() function.

Fix

Related Identifiers

CVE-2026-43038

ECHO-B634-CF31-7ECD

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/e41953e7d118e2702bcb217879c173d9d1d3cd4e · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43038 · Vendor Advisory
• https://git.kernel.org/stable/c/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7 · Patch
• https://git.kernel.org/stable/c/c438ba010171b70bad22fc18b1d5bdc3627476e8 · Patch
• https://git.kernel.org/stable/c/3d5127d998de617b130aae96b138dba22ac6a8a7 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43038 · Security Note
• https://git.kernel.org/stable/c/1ceeebd5bd6d855b17a5df625109bfe29129d7cf · Patch
• https://git.kernel.org/stable/c/86ab3e55673a7a49a841838776f1ab18d23a67b5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43038 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43038 · Security Note
• https://ubuntu.com/security/CVE-2026-43038 · Vendor Advisory
• https://git.kernel.org/stable/c/a2edbb6393972a02114b6003953a5cef3104fada · Patch
• https://git.kernel.org/stable/c/a4437faf135da293d16fcc4cc607316742bd0ebb · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43038 · Vendor Advisory