Executive brief
A critical vulnerability was identified in the Linux kernel's networking component that handles IPv4 traffic tunneled over IPv6. An attacker could send specially crafted network packets to trigger a memory error, potentially allowing them to execute unauthorized code or crash the system. This affects the core stability and security of servers and networking equipment using these specific tunneling protocols.
Technical details
A type confusion vulnerability exists in net/ipv6/ip6_tunnel.c within the ip4ip6_err() function. When processing errors, the function calls icmp_send() on a cloned socket buffer (skb) where the control block (cb[]) contains IPv6-specific metadata (struct inet6_skb_parm). However, icmp_send() interprets this region as IPv4 metadata (struct inet_skb_parm). Due to overlapping memory layouts, an offset (nhoff) from the IPv6 structure is misinterpreted as a record route (rr) pointer in the IPv4 structure. This causes __ip_options_echo() to read an attacker-controlled length from the packet and perform an out-of-bounds write into a fixed 40-byte stack buffer. The fix involves clearing the control block before processing and adding header validation.
Affected products
- Linux Linux Kernel All versions supporting IPv4 over IPv6 tunnels prior to the April 2026 patches
Timeline
- 2026-03-26: other: Patch authored by Eric Dumazet
- 2026-05-01: disclosed: CVE-2026-43037 published
References
- https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876
- https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5
- https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925
- https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8
- https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3
- https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39
- https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f