Vulnerability in linux (CVE-2026-43038, CVSS 9.8)

Summary

vulnerability in linux (CVE-2026-43038). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

Sashiko AI-review observed:

In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet
where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2
and passed to icmp6_send(), it uses IP6CB(skb2).

IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso
offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm
at offset 18.

If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao
would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called
and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).

This would scan the inner, attacker-controlled IPv6 packet starting at that
offset, potentially returning a fake TLV without checking if the remaining
packet length can hold the full 18-byte struct ipv6_destopt_hao.

Could mip6_addr_swap() then perform a 16-byte swap that extends past the end
of the packet data into skb_shared_info?

Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and
ip6ip6_err() to prevent this?

This patch implements the first suggestion.

I am not sure if ip6ip6_err() needs to be changed.
A separate patch would be better anyway.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

This vulnerability allows malicious attackers to remotely access systems through the internet and take control over the network. Specifically, attackers could harm the system using forged ICMP messages. Similar issues in the past have caused entire networks to go down. It is highly recommended for organizations to update their systems to the latest version.

The vulnerability involves the handling of IPv4 ICMP error packets in the ip6_err_gen_icmpv6_unreach() function. If an attacker sends a forged ICMPv4 error packet with a CIPSO option, an incorrect non-zero offset may be recognized in icmp6_send(), leading to operations extending beyond packet data bounds. This issue has been patched in the Linux Kernel.

❓ What is the problem

Critical vulnerability in Linux kernel concerning handling of IPv4 ICMP error packets.

📍 Affected scope

In the ip6_err_gen_icmpv6_unreach() function of Linux Kernel's ICMP processing.

🔥 Severity

Critical, with CVSS v3 score of 9.8, allowing remote attacks without authentication.

🔧 How to fix

Update to the latest patched version of the Linux Kernel.

🛡️ Workaround

No specific workaround; recommended to apply the patch.

🔍 Detection

Use network monitoring tools to track unusual ICMPv4 and ICMPv6 traffic.

Related past incidents Similar incidents extracted from past CVEs

CVE-2017-1000253

Similar issue in ICMPv6 affecting Linux kernel leading to memory corruption.

CVE-2018-18710

Vulnerability related to ICMP errors and IPv6 in Linux Kernel.

CVE-2020-12351

Bluetooth vulnerability in Linux kernel similar in its remote exploitation nature.

If this happens at your company Expected impact per business scenario

📌 ECサイトのサービス運用

ネットワークを経由してサーバーを不正に操作され、取引の信頼性に影響が出る可能性がある。

📌 社内ネットワークのセキュリティ

外部からの不正アクセスで機密情報が漏洩するリスクが高まる。

📌 クラウドサービスの提供

サービスの継続性が脅かされ、顧客への影響が出る可能性が高い。

Recommended action

企業はシステムの最新バージョンへのアップデートを迅速に実施し、ネットワークトラフィックの監視を強化するべきです。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'linux' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で linux を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"fixed":"5.10.253"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.203"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.168"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.134"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.81"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.12"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-43038 linux-lts Fixed in: 6.1.168-r0
Debian DEBIAN-CVE-2026-43038 linux Fixed in: 5.10.257-1
Ubuntu UBUNTU-CVE-2026-43038 linux Fixed in: 3.13.0-214.265

Vulnerability in linux (CVE-2026-43038)