Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-43037

critical

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem.

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
Timeline (UTC)
Published: 2026-05-01 15:16
Modified: 2026-11-11 23:10
NVD status: Modified
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:13 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥2.6.22 <5.10.253, ≥5.11 <5.15.203, ≥5.16 <6.1.168, ≥6.2 <6.6.134, ≥6.7 <6.12.81, ≥6.13 <6.18.22

Weakness classification (CWE)

CWE-787 CWE-121 CWE-843

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876
Patch / mitigation: https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5
Patch / mitigation: https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925
Patch / mitigation: https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8
Patch / mitigation: https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3
Patch / mitigation: https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39
Patch / mitigation: https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f
Patch / mitigation: https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629

References

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2001-1175CVE-2026-43283CVE-2026-43282CVE-2026-43280CVE-2026-43279