Vulnerability in c (CVE-2026-43186, CVSS 9.8)

Summary

vulnerability in c (CVE-2026-43186). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

On the receive path, __ioam6_fill_trace_data() uses trace->nodelen
to decide how much data to write for each node. It trusts this field
as-is from the incoming packet, with no consistency check against
trace->type (the 24-bit field that tells which data items are
present). A crafted packet can set nodelen=0 while setting type bits
0-21, causing the function to write ~100 bytes past the allocated
region (into skb_shared_info), which corrupts adjacent heap memory
and leads to a kernel panic.

Add a shared helper ioam6_trace_compute_nodelen() in ioam6.c to
derive the expected nodelen from the type field, and use it:

in ioam6_iptunnel.c (send path, existing validation) to replace
the open-coded computation;
in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose
nodelen is inconsistent with the type field, before any data is
written.

Per RFC 9197, bits 12-21 are each short (4-octet) fields, so they
are included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to
0xff1ffc00).

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability in the IPv6 functionality of the Linux kernel has been discovered. If exploited, an attacker can destabilize the system and compromise critical data. Similar to past incidents like "Heartbleed" or "Log4Shell," this vulnerability risks causing memory overflow. Companies should promptly update their systems and apply the available patch to prevent exploitation.

The Linux kernel's __ioam6_fill_trace_data() function had a heap buffer overflow issue, which trusted the trace->nodelen field on the receive path without consistency checks, allowing crafted packets to cause memory corruption and kernel panic. The patch introduces a shared helper ioam6_trace_compute_nodelen() to enforce consistency and prevent misuse. Administrators should apply the patch promptly to mitigate this vulnerability.

❓ What is the problem

Heap buffer overflow in __ioam6_fill_trace_data() within the Linux kernel's IPv6 function.

📍 Affected scope

__ioam6_fill_trace_data() function on the receive path in the Linux kernel.

🔥 Severity

Critical severity (CVSS 9.8), allowing remote exploitation, no privileges required.

🔧 How to fix

Apply the provided patch introducing ioam6_trace_compute_nodelen() for consistency checks.

🛡️ Workaround

No specific workaround, immediate patching is advised.

🔍 Detection

Check for packets with inconsistent nodelen and type fields using monitoring tools.

Related past incidents Similar incidents extracted from past CVEs

CVE-2014-0160 (Heartbleed)

Heartbleed allowed attackers to read memory from servers using OpenSSL, similar in its memory-related vulnerability nature.

CVE-2021-44228 (Log4Shell)

Log4Shell was an RCE exploit through logging, emphasizing the criticality of memory safety.

If this happens at your company Expected impact per business scenario

📌 In cloud environments where Linux servers are prevalent

Attacker could cause denial of service or data compromise across multiple tenants.

📌 In data centers heavily relying on IPv6 for internal communications

Internal network disruptions could occur, affecting business-critical applications.

📌 In organizations with high-security requirements such as finance or healthcare

Data integrity and confidentiality could be severely compromised.

Recommended action

Immediately apply the security patch to all vulnerable Linux kernel versions.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'c' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で c を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-43186 linux-lts Fixed in: 6.1.167-r0
Debian DEBIAN-CVE-2026-43186 linux Fixed in: 6.1.170-1
Ubuntu UBUNTU-CVE-2026-43186 linux-hwe-edge

Vulnerability in c (CVE-2026-43186)