# CVE-2026-43057: Linux Kernel denial of service in IPv6 tunneled traffic handling

Source: https://junglewise.ai/threats/cve-2026-43057-linux-kernel-denial-of-service-in-ipv6-tunneled-traffic-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-43057 · Severity: high · CVSS 7.5 · Published 2026-05-01

A vulnerability in the Linux kernel's networking component could allow an attacker to disrupt network services. The issue stems from how the system handles specific types of complex IPv6 network traffic, particularly when data is 'tunneled' or wrapped inside other protocols. If exploited, this could lead to a system crash or significant network performance degradation, impacting the availability of connected services and industrial equipment.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-43057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43057 being exploited in the wild.

**How severe is CVE-2026-43057?** High severity, with a CVSS score of 7.5, published 1 May 2026.

**Which products and versions are affected?** Linux Kernel Fixed in 2094a7cf91b71367b649f991aacc7b579f793d0b and related stable branches; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.

**Is there a fix for CVE-2026-43057?** A patch was published on 2026-04-11: Kernel stable branches updated Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43057 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-43057?** Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Linux kernel's 'net' subsystem due to improper handling of tunneled traffic during IPV6_CSUM GSO fallback. The NETIF_F_IPV6_CSUM flag only supports checksum offloading for packets without IPv6 extension headers; packets with these headers must fall back to software checksumming. The previous implementation failed to check the inner header length for tunneled packets (such as RFC 6951 SCTP in UDP), causing them to bypass the necessary software GSO path. This logic error can be triggered by remote network traffic, potentially leading to kernel instability or denial of service. Patches have been released across multiple Linux stable branches to extend header checks to inner protocols.

## Affected products

- Linux Linux Kernel Fixed in 2094a7cf91b71367b649f991aacc7b579f793d0b and related stable branches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

## Timeline

- 2026-05-01: disclosed: CVE published
- 2026-04-11: patched: Kernel stable branches updated

## References

- [https://git.kernel.org/stable/c/2094a7cf91b71367b649f991aacc7b579f793d0b](https://git.kernel.org/stable/c/2094a7cf91b71367b649f991aacc7b579f793d0b)
- [https://git.kernel.org/stable/c/33670f780e0120c3dacda188c512bbffe0b6044c](https://git.kernel.org/stable/c/33670f780e0120c3dacda188c512bbffe0b6044c)
- [https://git.kernel.org/stable/c/732fdeb2987c94b439d51f5cb9addddc2fc48c42](https://git.kernel.org/stable/c/732fdeb2987c94b439d51f5cb9addddc2fc48c42)
- [https://git.kernel.org/stable/c/a98b78116a27e2a57b696b569b2cb431c95cf9b6](https://git.kernel.org/stable/c/a98b78116a27e2a57b696b569b2cb431c95cf9b6)
- [https://git.kernel.org/stable/c/c4336a07eb6b2526dc2b62928b5104b41a7f81f5](https://git.kernel.org/stable/c/c4336a07eb6b2526dc2b62928b5104b41a7f81f5)
- [https://git.kernel.org/stable/c/ed71cf465c75f5688b07a35d373cd1d6b589c8ea](https://git.kernel.org/stable/c/ed71cf465c75f5688b07a35d373cd1d6b589c8ea)
- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)