Executive brief
A vulnerability exists in the Linux kernel's networking component responsible for IPv6 In-situ Operations, Administration, and Maintenance (IOAM). This component is used to monitor and trace network performance. An attacker could exploit this flaw to cause a system crash or potentially access sensitive memory, leading to service disruptions or data exposure.
Technical details
An out-of-bounds (OOB) read vulnerability exists in net/ipv6/ioam6.c within the __ioam6_fill_trace_data function. When trace->type.bit6 is set, the kernel attempts to retrieve a transmit (TX) queue index using skb_get_tx_queue. If a packet is on the receive (RX) path and the ingress device has more RX queues than the egress device has TX queues, the index exceeds the bounds of the dev->_tx[] array. Additionally, the function lacked proper spinlock synchronization (spin_lock_bh) around qdisc_qstats_qlen_backlog, leading to potential race conditions between softirq and process contexts. The fix introduces a bounds check against dev->num_tx_queues and implements the necessary locking.
Affected products
- Linux Linux Kernel 5.17 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-08: patched: Fixed in mainline kernel via commit b30b1675aa2bcf0491fd3830b051df4e08a7c8ca
- 2026-05-06: disclosed: CVE-2026-43083 published