CVE-2026-43037

linux kernel

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-43037

Katalog CVE

CVSS 9.8 · Critical EPSS 0,83%

Kerentanan Out-of-bounds Write pada linux kernel. Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

Rincian

Terbit di NVD
1 Mei 2026
Terakhir diubah
12 Agustus 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-787: Out-of-bounds Write
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
EPSS (30 hari)
0,83% peluang dieksploitasi; lebih tinggi dari 56,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
linux linux kernel Versi 2.6.22 hingga sebelum 5.10.253
linux linux kernel Versi 5.11 hingga sebelum 5.15.203
linux linux kernel Versi 5.16 hingga sebelum 6.1.168
linux linux kernel Versi 6.2 hingga sebelum 6.6.134
linux linux kernel Versi 6.7 hingga sebelum 6.12.81
linux linux kernel Versi 6.13 hingga sebelum 6.18.22
linux linux kernel Versi 6.19 hingga sebelum 6.19.12
linux linux kernel Versi 7.0 rc1
linux linux kernel Versi 7.0 rc2
linux linux kernel Versi 7.0 rc3
linux linux kernel Versi 7.0 rc4
linux linux kernel Versi 7.0 rc5
linux linux kernel Versi 7.0 rc6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.