PT-2026-37409 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-43099

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A null pointer dereference exists in the icmp build probe() function. This occurs when the IPv6 stack is not active (specifically when CONFIG IPV6=m and not loaded), causing ipv6 stub->ipv6 dev find() to return ERR PTR(-EAFNOSUPPORT). Passing this error pointer to dev hold() results in a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43099

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-43099 · Security Note
• https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d · Note
• https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5 · Note
• https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48 · Note
• https://twitter.com/VulmonFeeds/status/2052033465902592305 · Twitter Post
• https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8 · Note
• https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964 · Note