{"id":"CVE-2026-43037","revision":"6f99afc373fb48649567b730a2392bfa","records":[{"revision":"6f99afc373fb48649567b730a2392bfa","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43037","aliases":[],"title":"ip6_tunnel: clear skb2->cb[] in ip4ip6_err()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2->cb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt->__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2->cb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl >= 5).","state":0,"publishedAt":"2026-05-01T14:15:35.314+00:00","modifiedAt":"2026-10-19T19:06:10.69+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/ip6_tunnel.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"ea9f65b27c8404e164848ebff1443310fd187629\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"d6621f60192fe10c047a4487be42a6f4c150707f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"a0c4ce9900a108eaf55d0f3b399cb55999647d39\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"1063515ce15ff31065c4e7f8265f4c2fd3c54876\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"4a622658f384b03560834cbe8ffcfe69a278f7c8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d3efafcc933fd2ffd169d7dc4f980393a13796\",\n                            \"lessThan\": \"2edfa31769a4add828a7e604b21cb82aaaa05925\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/ip6_tunnel.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.22\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.22\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.134\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.81\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.22\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.12\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629","https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f","https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5","https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39","https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876","https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3","https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8","https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43037","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43037","identifiers":["CVE-2026-43037"]},"retained":false,"historicalAffected":[]}],"coverage":[]}