Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could allow a remote attacker to crash the system. The issue exists in the In-situ Operations, Administration, and Maintenance (IOAM) feature, which is used for monitoring network telemetry. An exploit could lead to a denial-of-service condition, impacting the availability of affected servers or network devices.
Technical details
A NULL pointer dereference vulnerability exists in the net/ipv6/ioam6.c component of the Linux kernel. The function __ioam6_fill_trace_data() failed to validate the return value of __in6_dev_get(), which can return NULL under certain conditions when processing IPv6 IOAM trace data. A remote attacker can trigger this flaw by sending specially crafted IPv6 packets, leading to a kernel panic (Denial of Service). The fix introduces proper NULL checks for the inet6_dev pointer, utilizes skb_dst_dev_rcu() for RCU-safe device access, and adds READ_ONCE() macros to ensure atomic reads of sysctl values. Patches have been released for various stable kernel branches including 6.19.14 and 6.18.24.
Affected products
- Linux Linux Kernel 5.15 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-02: other: Patch authored by Eric Dumazet
- 2026-05-06: advisory: CVE-2026-43101 published
- 2026-05-11: other: NIST initial analysis completed