Executive brief
A vulnerability exists in the Linux kernel's IPv6 networking component, specifically within the In-situ Operations and Management (IOAM) feature. This component is used for monitoring and tracing network performance. An attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access, impacting the stability and security of servers and networking equipment running affected versions of Linux.
Technical details
An integer wraparound vulnerability exists in net/ipv6/ioam6.c within the ioam6_fill_trace_data() function. The variable 'sclen', which stores the schema contribution to the trace length, was incorrectly defined as a u8 (8-bit unsigned integer). When bit 22 is enabled with a maximum schema payload, the calculation (1 + 1020 / 4) results in 256, which wraps around to 0 in an 8-bit field. This wraparound causes the code to bypass remaining-space checks, leading to a buffer overrun when the 4-byte schema header and full payload are subsequently copied. The fix changes the variable type to an unsigned int to correctly handle the length calculation. This is reachable over the network via IPv6 packets utilizing IOAM6 tracing.
Affected products
- Linux Linux Kernel Fixed in versions 184d2e9, 5e67ba9, 77695a6, d1b0410, d6e1c9b, e96d48b
Timeline
- 2026-03-25: other: Vulnerability fixed in source code by Pengpeng Hou
- 2026-05-08: advisory: CVE-2026-43341 published by kernel.org
References
- https://git.kernel.org/stable/c/184d2e9db27c0f76226b5cad16fe29510a5d2280
- https://git.kernel.org/stable/c/5e67ba9bb531e1ec6599a82a065dea9040b9ce50
- https://git.kernel.org/stable/c/77695a69baca9b99d95fad09fc78c2318736604f
- https://git.kernel.org/stable/c/d1b041080086e91d3733a5438a8c51ad5d3d8e09
- https://git.kernel.org/stable/c/d6e1c9b02d85a4f1f4ba6d68e916d9b610a3ed7d
- https://git.kernel.org/stable/c/e96d48b37708d53cbdc47f6f60b0714fc4a5f596