CVE-2026-43037

CRITICAL EPSS 42.6%
Published May 1, 20261mo ago · Modified Jun 27, 20262d ago
9.8 CVSS 3.1
Critical
Find Similar
Published May 1, 2026 1mo ago
Last Modified Jun 27, 2026 2d ago

Description

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
42.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-787 Out-of-bounds Write Memory Safety
CWE-843

Affected Products 13

VendorProductVersionRange
linuxlinux_kernel*≥2.6.22  –  <5.10.253
linuxlinux_kernel*≥5.11  –  <5.15.203
linuxlinux_kernel*≥5.16  –  <6.1.168
linuxlinux_kernel*≥6.2  –  <6.6.134
linuxlinux_kernel*≥6.7  –  <6.12.81
linuxlinux_kernel*≥6.13  –  <6.18.22
linuxlinux_kernel*≥6.19  –  <6.19.12
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 39

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629
    Patch