CVE-2026-43037

Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 01 May 2026, 14:15
Last modified:11 May 2026, 22:16

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.1% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 May 2026, 14:15
Published
Vulnerability first disclosed
11 May 2026, 22:16
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.10%• Percentile: 27%

Techniques & Countermeasures

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • linux•linux

    ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < ea9f65b27c8404e164848ebff1443310fd187629 | ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < d6621f60192fe10c047a4487be42a6f4c150707f | ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < 2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5 | ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < a0c4ce9900a108eaf55d0f3b399cb55999647d39 | ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < 1063515ce15ff31065c4e7f8265f4c2fd3c54876 | ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < 590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3 | ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < 4a622658f384b03560834cbe8ffcfe69a278f7c8 | ≥ c4d3efafcc933fd2ffd169d7dc4f980393a13796, < 2edfa31769a4add828a7e604b21cb82aaaa05925 | 2.6.22

  • linux•linux_kernel

    ≥ 2.6.22, < 5.10.253 | ≥ 5.11, < 5.15.203 | ≥ 5.16, < 6.1.168 | ≥ 6.2, < 6.6.134 | ≥ 6.7, < 6.12.81 | ≥ 6.13, < 6.18.22 | ≥ 6.19, < 6.19.12 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6

References (8)