# CVE-2026-43038: Linux Kernel type confusion in ip6_err_gen_icmpv6_unreach

Source: https://junglewise.ai/threats/cve-2026-43038-linux-kernel-type-confusion-in-ip6-err-gen-icmpv6-unreach  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-43038 · Severity: critical · CVSS 9.8 · Published 2026-05-01

A vulnerability was identified in the Linux kernel's networking component that handles communication between different internet protocol versions (IPv4 and IPv6). An attacker could send specially crafted network packets to trigger a memory error, potentially allowing them to crash the system or gain unauthorized access. This affects systems acting as gateways or using specific tunneling protocols like SIT (IPv6 over IPv4).

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-43038 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43038 being exploited in the wild.

**How severe is CVE-2026-43038?** Critical severity, with a CVSS score of 9.8, published 1 May 2026.

**Which products and versions are affected?** Linux Kernel All versions prior to the April 2026 patches.

**Is there a fix for CVE-2026-43038?** A patch was published on 2026-04-18: Patch committed to stable tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43038 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-43038?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type confusion vulnerability exists in the 'ip6_err_gen_icmpv6_unreach' function within the Linux kernel's IPv6 stack. When an IPv4 ICMP error packet is cloned to generate an ICMPv6 error, the control block (cb) remains populated with IPv4-specific data (inet_skb_parm). The IPv6 stack subsequently interprets this data as an IPv6 control block (inet6_skb_parm). Specifically, the 'cipso' offset from the IPv4 structure overlaps with the 'dsthao' offset in the IPv6 structure. An attacker can provide a forged ICMPv4 packet with a CIPSO option to manipulate the 'dsthao' offset, causing 'mip6_addr_swap' to perform a 16-byte swap at an attacker-controlled offset. This can result in out-of-bounds memory writes into 'skb_shared_info', leading to a system crash or arbitrary code execution. The fix involves zeroing the control block during the conversion process.

## Affected products

- Linux Linux Kernel All versions prior to the April 2026 patches
- Red Hat Enterprise Linux 10.0
- Red Hat Enterprise Linux 9.2

## Timeline

- 2026-03-26: disclosed: Initial patch submission by Eric Dumazet
- 2026-04-18: patched: Patch committed to stable tree
- 2026-05-01: advisory: CVE-2026-43038 published

## References

- [https://git.kernel.org/stable/c/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7](https://git.kernel.org/stable/c/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7)
- [https://git.kernel.org/stable/c/1ceeebd5bd6d855b17a5df625109bfe29129d7cf](https://git.kernel.org/stable/c/1ceeebd5bd6d855b17a5df625109bfe29129d7cf)
- [https://git.kernel.org/stable/c/3d5127d998de617b130aae96b138dba22ac6a8a7](https://git.kernel.org/stable/c/3d5127d998de617b130aae96b138dba22ac6a8a7)
- [https://git.kernel.org/stable/c/86ab3e55673a7a49a841838776f1ab18d23a67b5](https://git.kernel.org/stable/c/86ab3e55673a7a49a841838776f1ab18d23a67b5)
- [https://git.kernel.org/stable/c/a2edbb6393972a02114b6003953a5cef3104fada](https://git.kernel.org/stable/c/a2edbb6393972a02114b6003953a5cef3104fada)
- [https://git.kernel.org/stable/c/a4437faf135da293d16fcc4cc607316742bd0ebb](https://git.kernel.org/stable/c/a4437faf135da293d16fcc4cc607316742bd0ebb)
- [https://git.kernel.org/stable/c/c438ba010171b70bad22fc18b1d5bdc3627476e8](https://git.kernel.org/stable/c/c438ba010171b70bad22fc18b1d5bdc3627476e8)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)