PT-2026-37526 · Linux+3 · Linux+144

Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-43186

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap buffer overflow exists in the ioam6 fill trace data() function. The function relies on the nodelen field from incoming packets to determine the amount of data to write for each node without verifying it against the type field. A specially crafted packet can set nodelen to 0 while setting type bits 0-21, causing the function to write approximately 100 bytes beyond the allocated region into skb shared info. This results in the corruption of adjacent heap memory and leads to a kernel panic.

Recommendations Implement the ioam6 trace compute nodelen() helper function to derive the expected nodelen from the type field. In ioam6 iptunnel.c, use this helper to replace open-coded computation on the send path. In exthdrs.c, use this helper within ipv6 hop ioam on the receive path to drop packets where the nodelen is inconsistent with the type field before data is written.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-43186

Affected Products

Linux

Linux-Allwinner-5.19

Linux-Aws

Linux-Aws-5.0

Linux-Aws-5.11

Linux-Aws-5.13

Linux-Aws-5.15

Linux-Aws-5.19

Linux-Aws-5.3

Linux-Aws-5.8

Linux-Aws-6.14

Linux-Aws-6.17

Linux-Aws-6.2

Linux-Aws-6.5

Linux-Aws-6.8

Linux-Aws-Fips

Linux-Azure

Linux-Azure-5.11

Linux-Azure-5.13

Linux-Azure-5.15

Linux-Azure-5.19

Linux-Azure-5.3

Linux-Azure-5.8

Linux-Azure-6.11

Linux-Azure-6.14

Linux-Azure-6.17

Linux-Azure-6.2

Linux-Azure-6.5

Linux-Azure-6.8

Linux-Azure-Edge

Linux-Azure-Fde

Linux-Azure-Fde-5.15

Linux-Azure-Fde-5.19

Linux-Azure-Fde-6.14

Linux-Azure-Fde-6.17

Linux-Azure-Fde-6.2

Linux-Azure-Fde-6.8

Linux-Azure-Fips

Linux-Azure-Nvidia

Linux-Azure-Nvidia-6.14

Linux-Bluefield

Linux-Fips

Linux-Gcp

Linux-Gcp-5.11

Linux-Gcp-5.13

Linux-Gcp-5.15

Linux-Gcp-5.19

Linux-Gcp-5.3

Linux-Gcp-5.8

Linux-Gcp-6.11

Linux-Gcp-6.14

Linux-Gcp-6.17

Linux-Gcp-6.2

Linux-Gcp-6.5

Linux-Gcp-6.8

Linux-Gcp-Fips

Linux-Gke

Linux-Gke-4.15

Linux-Gkeop-5.15

Linux-Gke-5.4

Linux-Gkeop

Linux-Hwe

Linux-Hwe-5.11

Linux-Hwe-5.13

Linux-Hwe-5.15

Linux-Hwe-5.19

Linux-Hwe-5.8

Linux-Hwe-6.11

Linux-Hwe-6.14

Linux-Hwe-6.17

Linux-Hwe-6.2

Linux-Hwe-6.5

Linux-Hwe-6.8

Linux-Hwe-Edge

Linux-Ibm

Linux-Ibm-5.15

Linux-Ibm-6.8

Linux-Intel-5.13

Linux-Intel-Iot-Realtime

Linux-Intel-Iotg

Linux-Intel-Iotg-5.15

Linux-Kvm

Linux-Lowlatency

Linux-Lowlatency-Hwe-5.15

Linux-Lowlatency-Hwe-5.19

Linux-Lowlatency-Hwe-6.11

Linux-Lowlatency-Hwe-6.2

Linux-Lowlatency-Hwe-6.5

Linux-Lowlatency-Hwe-6.8

Linux-Lts

Linux-Nvidia

Linux-Nvidia-6.11

Linux-Nvidia-6.2

Linux-Nvidia-6.5

Linux-Nvidia-6.8

Linux-Nvidia-Lowlatency

Linux-Nvidia-Tegra

Linux-Nvidia-Tegra-5.15

Linux-Nvidia-Tegra-Igx

Linux-Oem

Linux-Oem-5.10

Linux-Oem-5.13

Linux-Oem-5.14

Linux-Oem-5.17

Linux-Oem-5.6

Linux-Oem-6.0

Linux-Oem-6.1

Linux-Oem-6.11

Linux-Oem-6.14

Linux-Oem-6.17

Linux-Oem-6.5

Linux-Oem-6.8

Linux-Oracle

Linux-Oracle-5.0

Linux-Oracle-5.11

Linux-Oracle-5.13

Linux-Oracle-5.15

Linux-Oracle-5.3

Linux-Oracle-5.8

Linux-Oracle-6.14

Linux-Oracle-6.17

Linux-Oracle-6.5

Linux-Oracle-6.8

Linux-Raspi

Linux-Raspi-Realtime

Linux-Raspi2

Linux-Realtime

Linux-Realtime-6.14

Linux-Realtime-6.17

Linux-Realtime-6.8

Linux-Riscv

Linux-Riscv-5.11

Linux-Riscv-5.15

Linux-Riscv-5.19

Linux-Riscv-5.8

Linux-Riscv-6.14

Linux-Riscv-6.17

Linux-Riscv-6.5

Linux-Riscv-6.8

Linux-Starfive-5.19

Linux-Starfive-6.2

Linux-Starfive-6.5

Linux-Xilinx

Linux-Xilinx-Zynqmp

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/0591d6509c2ff13f09ea2998434aba0c0472e978 · Patch
• https://git.kernel.org/stable/c/f4d9d4b8fd839719d564651671e24c62c545c23b · Patch
• https://git.kernel.org/stable/c/632d233cf2e64a46865ae2c064ae3c9df7c8864f · Patch
• https://git.kernel.org/stable/c/6db8b56eed62baacaf37486e83378a72635c04cc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43186 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-43186 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43186 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43186 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43186 · Security Note
• https://git.kernel.org/stable/c/fb3c662fafebc5b9d74417ed1de8759f6bb72143 · Patch
• https://git.kernel.org/stable/c/e90346a2f1e8917d5760a44a1f61c44e3b36d96b · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43186 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43186 · Vendor Advisory
• https://git.kernel.org/stable/c/ea3632aefc04205436868541638e26f4a74d5637 · Patch
• https://t.me/cveNotify/163108 · Telegram Post