PT-2026-37526 · Linux · Linux Kernel
CVE-2026-43186
·
Published
2026-05-06
·
Updated
2026-07-17
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A heap buffer overflow exists in the
ioam6 fill trace data() function. The function relies on the nodelen field from incoming packets to determine the amount of data to write for each node without verifying it against the type field. A specially crafted packet can set nodelen to 0 while setting type bits 0-21, causing the function to write approximately 100 bytes beyond the allocated region into skb shared info. This results in the corruption of adjacent heap memory and leads to a kernel panic.Recommendations
Implement the
ioam6 trace compute nodelen() helper function to derive the expected nodelen from the type field.
In ioam6 iptunnel.c, use this helper to replace open-coded computation on the send path.
In exthdrs.c, use this helper within ipv6 hop ioam on the receive path to drop packets where the nodelen is inconsistent with the type field before data is written.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel