CVE-2026-43341

Aliases:UBUNTU-CVE-2026-43341DEBIAN-CVE-2026-43341
Advisory lineage Upstream: 0 Downstream: 22
Modified
Published: 08 May 2026, 13:37
Last modified:05 Aug 2026, 12:27

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.41% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 May 2026, 13:37
Published
Vulnerability first disclosed
05 Aug 2026, 12:27
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer. Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.

CVSS Metrics

  • v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.41%• Percentile: 35%

Affected Systems

  • debian•linux

    < 6.1.170-1 | < 6.12.85-1 | < 6.19.12-1

  • ubuntu•linux

    < 5.15.0-185.195 | < 6.8.0-134.134 | < 6.17.0-40.40

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    < 5.15.0-1111.118 | < 6.8.0-1060.63 | < 6.17.0-1019.19

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.15

    < 5.15.0-1111.118~20.04.1

  • ubuntu•linux-aws-5.19

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-6.14

    all

  • ubuntu•linux-aws-6.17

    < 6.17.0-1019.19~24.04.1

  • ubuntu•linux-aws-6.2

    all

  • ubuntu•linux-aws-6.5

    all

  • ubuntu•linux-aws-6.8

    < 6.8.0-1060.63~22.04.1

  • ubuntu•linux-aws-fips

    all | < 5.15.0-1111.118+fips1 | < 6.8.0-1060.63+fips1

  • ubuntu•linux-azure

    all | < 5.15.0-1116.125 | < 6.8.0-1063.71 | all

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.15

    < 5.15.0-1116.125~20.04.1

  • ubuntu•linux-azure-5.19

    all

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-6.11

    all

  • ubuntu•linux-azure-6.14

    all

  • ubuntu•linux-azure-6.17

    < 6.17.0-1021.21~24.04.1

  • ubuntu•linux-azure-6.2

    all

  • ubuntu•linux-azure-6.5

    all

  • ubuntu•linux-azure-6.8

    < 6.8.0-1063.71~22.04.1

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    all | all | < 6.8.0-1062.69 | all | all

  • ubuntu•linux-azure-fde-5.15

    < 5.15.0-1116.125~20.04.1

  • ubuntu•linux-azure-fde-5.19

    all

  • ubuntu•linux-azure-fde-6.14

    all

  • ubuntu•linux-azure-fde-6.2

    all

  • ubuntu•linux-azure-fde-6.8

    < 6.8.0-1062.69~22.04.1

  • ubuntu•linux-azure-fde-7.0

    all

  • ubuntu•linux-azure-fips

    all | < 5.15.0-1116.125+fips1 | < 6.8.0-1062.69+fips1

  • ubuntu•linux-azure-nvidia

    all

  • ubuntu•linux-azure-nvidia-6.14

    all

  • ubuntu•linux-bluefield

    all | < 5.15.0-1095.97 | < 6.8.0-1026.30

  • ubuntu•linux-fips

    all | < 5.15.0-185.195+fips1 | < 6.8.0-134.134+fips1

  • ubuntu•linux-gcp

    all | < 5.15.0-1111.121 | < 6.8.0-1063.69 | < 6.17.0-1020.22

  • ubuntu•linux-gcp-5.11

    all

  • ubuntu•linux-gcp-5.13

    all

  • ubuntu•linux-gcp-5.15

    < 5.15.0-1111.121~20.04.1

  • ubuntu•linux-gcp-5.19

    all

  • ubuntu•linux-gcp-5.3

    all

  • ubuntu•linux-gcp-5.8

    all

Showing first 50 affected entries in server-rendered view.

References (37)