{"id":"CVE-2026-43341","revision":"58340872868f4dc396f07883a916a259","records":[{"revision":"58340872868f4dc396f07883a916a259","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43341","aliases":[],"title":"net/ipv6: ioam6: prevent schema length wraparound in trace fill","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: ioam6: prevent schema length wraparound in trace fill\n\nioam6_fill_trace_data() stores the schema contribution to the trace\nlength in a u8. With bit 22 enabled and the largest schema payload,\nsclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the\nremaining-space check. __ioam6_fill_trace_data() then positions the\nwrite cursor without reserving the schema area but still copies the\n4-byte schema header and the full schema payload, overrunning the trace\nbuffer.\n\nKeep sclen in an unsigned int so the remaining-space check and the write\ncursor calculation both see the full schema length.","state":0,"publishedAt":"2026-05-08T13:37:19.256+00:00","modifiedAt":"2026-10-19T19:16:27.02+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/ioam6.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8c6f6fa6772696be0c047a711858084b38763728\",\n                            \"lessThan\": \"d3a1fb2ca323d7a4e10ab3afbfa25e6d8921e4f2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c6f6fa6772696be0c047a711858084b38763728\",\n                            \"lessThan\": \"e96d48b37708d53cbdc47f6f60b0714fc4a5f596\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c6f6fa6772696be0c047a711858084b38763728\",\n                            \"lessThan\": \"d1b041080086e91d3733a5438a8c51ad5d3d8e09\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c6f6fa6772696be0c047a711858084b38763728\",\n                            \"lessThan\": \"77695a69baca9b99d95fad09fc78c2318736604f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c6f6fa6772696be0c047a711858084b38763728\",\n                            \"lessThan\": \"184d2e9db27c0f76226b5cad16fe29510a5d2280\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c6f6fa6772696be0c047a711858084b38763728\",\n                            \"lessThan\": \"d6e1c9b02d85a4f1f4ba6d68e916d9b610a3ed7d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c6f6fa6772696be0c047a711858084b38763728\",\n                            \"lessThan\": \"5e67ba9bb531e1ec6599a82a065dea9040b9ce50\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/ioam6.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.134\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.81\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.22\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.12\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/d3a1fb2ca323d7a4e10ab3afbfa25e6d8921e4f2","https://git.kernel.org/stable/c/e96d48b37708d53cbdc47f6f60b0714fc4a5f596","https://git.kernel.org/stable/c/d1b041080086e91d3733a5438a8c51ad5d3d8e09","https://git.kernel.org/stable/c/77695a69baca9b99d95fad09fc78c2318736604f","https://git.kernel.org/stable/c/184d2e9db27c0f76226b5cad16fe29510a5d2280","https://git.kernel.org/stable/c/d6e1c9b02d85a4f1f4ba6d68e916d9b610a3ed7d","https://git.kernel.org/stable/c/5e67ba9bb531e1ec6599a82a065dea9040b9ce50"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43341","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43341","identifiers":["CVE-2026-43341"]},"retained":false,"historicalAffected":[]}],"coverage":[]}