ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Summary

CVECVE-2026-43037
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-01 15:16:48 UTC
Updated2026-07-20 12:19:21 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

Risk And Classification

Primary CVSS: v3.1 8.8 HIGH from ADP

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.000530000 probability, percentile 0.164060000 (date 2026-05-05)

Problem Types: CWE-787 | CWE-843 | CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')


VersionSourceTypeScoreSeverityVector
3.1ADPCVSS8.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.10b0ca135-0b70-47e7-9f44-1890c2a1c46cSecondary8.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 ea9f65b27c8404e164848ebff1443310fd187629 git Not specified
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 d6621f60192fe10c047a4487be42a6f4c150707f git Not specified
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5 git Not specified
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 a0c4ce9900a108eaf55d0f3b399cb55999647d39 git Not specified
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 1063515ce15ff31065c4e7f8265f4c2fd3c54876 git Not specified
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3 git Not specified
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 4a622658f384b03560834cbe8ffcfe69a278f7c8 git Not specified
CNA Linux Linux affected c4d3efafcc933fd2ffd169d7dc4f980393a13796 2edfa31769a4add828a7e604b21cb82aaaa05925 git Not specified
CNA Linux Linux affected 2.6.22 Not specified
CNA Linux Linux unaffected 2.6.22 semver Not specified
CNA Linux Linux unaffected 5.10.253 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.203 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.168 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.134 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.81 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.22 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.12 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified
ADP Red Hat NVIDIA For RHEL 10 unaffected 0:6.12.0-212.10.el10nv * rpm Not specified
ADP Red Hat NVIDIA For RHEL 10 unaffected 0:6.12.0-231.12.el10nv * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 10 unaffected 0:6.12.0-211.22.1.el10_2 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 10 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support unaffected 0:6.12.0-55.77.1.el10_0 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION unaffected 0:2.6.32-754.61.1.el6 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support unaffected 0:3.10.0-1160.155.1.rt56.1307.el7 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support unaffected 0:3.10.0-1160.153.1.el7 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8 unaffected 0:4.18.0-553.132.1.rt7.473.el8_10 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8 unaffected 0:4.18.0-553.132.1.el8_10 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support unaffected 0:4.18.0-305.194.1.el8_4 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On unaffected 0:4.18.0-305.194.1.el8_4 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support unaffected 0:4.18.0-372.195.1.el8_6 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On unaffected 0:4.18.0-372.195.1.el8_6 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service unaffected 0:4.18.0-477.145.1.el8_8 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions unaffected 0:4.18.0-477.145.1.el8_8 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9 unaffected 0:5.14.0-687.15.1.el9_8 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions unaffected 0:5.14.0-284.174.1.el9_2 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions unaffected 0:5.14.0-284.174.1.rt14.459.el9_2 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions unaffected 0:5.14.0-427.129.1.el9_4 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support unaffected 0:5.14.0-570.119.1.el9_6 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support Not specified Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.12 unaffected 412.86.202606140301-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.13 unaffected 413.92.202606160406-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.14 unaffected 414.92.202606231112-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.15 unaffected 415.92.202606200237-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.17 unaffected 417.94.202606250942-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.18 unaffected 418.94.202606051320-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.19 unaffected 4.19.9.6.202606100451-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.20 unaffected 4.20.9.6.202606101223-0 * rpm Not specified
ADP Red Hat Red Hat OpenShift Container Platform 4.21 unaffected 4.21.9.6.202606101139-0 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 10 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9 Not specified Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/errata/RHSA-2026:25186 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25200 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/errata/RHSA-2026:28749 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25217 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25191 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25120 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:28741 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25193 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:23224 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:34098 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:22900 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25181 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:24343 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:27719 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:28887 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/errata/RHSA-2026:28962 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:22940 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25533 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:26542 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:28740 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/security/cve/CVE-2026-43037 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:23237 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:27729 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:41236 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:22964 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
bugzilla.redhat.com/show_bug.cgi 0b0ca135-0b70-47e7-9f44-1890c2a1c46c bugzilla.redhat.com
access.redhat.com/errata/RHSA-2026:28738 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/errata/RHSA-2026:28750 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:26535 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:33486 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:25534 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43037.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c security.access.redhat.com
access.redhat.com/errata/RHSA-2026:25121 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/errata/RHSA-2026:28742 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/errata/RHSA-2026:28748 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:26528 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Additional Advisory Data

SourceTimeEvent
ADP2026-05-01T00:00:00.000ZReported to Red Hat.
ADP2026-05-01T00:00:00.000ZMade public.

Solutions

ADP: RHSA-2026:25534: NVIDIA for RHEL 10

ADP: RHSA-2026:33486: NVIDIA for RHEL 10

ADP: RHSA-2026:27719: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)

ADP: RHSA-2026:27729: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)

ADP: RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)

ADP: RHSA-2026:26528: Red Hat OpenShift Container Platform 4.12

ADP: RHSA-2026:26542: Red Hat OpenShift Container Platform 4.13

ADP: RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14

ADP: RHSA-2026:28962: Red Hat OpenShift Container Platform 4.15

ADP: RHSA-2026:34098: Red Hat OpenShift Container Platform 4.17

ADP: RHSA-2026:25181: Red Hat OpenShift Container Platform 4.18

ADP: RHSA-2026:25200: Red Hat OpenShift Container Platform 4.19

ADP: RHSA-2026:25193: Red Hat OpenShift Container Platform 4.20

ADP: RHSA-2026:25186: Red Hat OpenShift Container Platform 4.21

ADP: RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)

ADP: RHSA-2026:25191: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)

ADP: RHSA-2026:22940: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)

ADP: RHSA-2026:23237: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)

ADP: RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)

ADP: RHSA-2026:25217: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)

ADP: RHSA-2026:28742: Red Hat Enterprise Linux BaseOS (v. 10)

ADP: RHSA-2026:25121: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)

ADP: RHSA-2026:28749: Red Hat Enterprise Linux BaseOS (v. 8)

ADP: RHSA-2026:26535: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)

ADP: RHSA-2026:25533: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)

ADP: RHSA-2026:22964: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)

ADP: RHSA-2026:28748: Red Hat Enterprise Linux BaseOS E4S (v.8.8)

ADP: RHSA-2026:28750: Red Hat Enterprise Linux BaseOS E4S (v.9.2)

ADP: RHSA-2026:28738: Red Hat Enterprise Linux BaseOS E4S (v.9.4)

ADP: RHSA-2026:28740: Red Hat Enterprise Linux BaseOS EUS (v.9.6)

ADP: RHSA-2026:28741: Red Hat Enterprise Linux BaseOS (v. 9)

ADP: RHSA-2026:25120: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)

ADP: RHSA-2026:22900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)

Workarounds

ADP: Mitigation for this issue is to skip loading the affected module `ip6_tunnel` onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ We may also want to detection and monitoring an affected system as below: ~~~ Monitor for exploitation attempts: # Enable kernel audit for IPv6 tunnel operations auditctl -a always,exit -F arch=b64 -S socket -F a0=10 -F a1=3 -k ipv6_tunnel # Monitor system logs for kernel panics/crashes journalctl -k -p err -f | grep -i "ip6_tunnel\|icmp\|stack" ~~~

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report