{"id":"CVE-2026-43186","title":"ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace->nodelen\nto decide how much data to write f…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < f4d9d4b8fd839719d564651671e24c62c545c23b","Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < fb3c662fafebc5b9d74417ed1de8759f6bb72143","Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 632d233cf2e64a46865ae2c064ae3c9df7c8864f","Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 0591d6509c2ff13f09ea2998434aba0c0472e978","Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < e90346a2f1e8917d5760a44a1f61c44e3b36d96b","Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < ea3632aefc04205436868541638e26f4a74d5637","Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 6db8b56eed62baacaf37486e83378a72635c04cc","Linux 5.15"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:15:25.722836Z"},"published":"2026-05-06","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:35.434Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43186","references":[{"url":"https://git.kernel.org/stable/c/f4d9d4b8fd839719d564651671e24c62c545c23b"},{"url":"https://git.kernel.org/stable/c/fb3c662fafebc5b9d74417ed1de8759f6bb72143"},{"url":"https://git.kernel.org/stable/c/632d233cf2e64a46865ae2c064ae3c9df7c8864f"},{"url":"https://git.kernel.org/stable/c/0591d6509c2ff13f09ea2998434aba0c0472e978"},{"url":"https://git.kernel.org/stable/c/e90346a2f1e8917d5760a44a1f61c44e3b36d96b"},{"url":"https://git.kernel.org/stable/c/ea3632aefc04205436868541638e26f4a74d5637"},{"url":"https://git.kernel.org/stable/c/6db8b56eed62baacaf37486e83378a72635c04cc"}],"tags":["cve.org"],"epss":0.00861,"epssPercentile":0.57763,"ingestedAt":"2026-10-16T17:24:46.685Z","slug":"CVE-2026-43186","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace->nodelen\nto decide how much data to write for each node. It trusts this field\nas-is from the incoming packet, with no consistency check against\ntrace->type (the 24-bit field that tells which data items are\npresent). A crafted packet can set nodelen=0 while setting type bits\n0-21, causing the function to write ~100 bytes past the allocated\nregion (into skb_shared_info), which corrupts adjacent heap memory\nand leads to a kernel panic.\n\nAdd a shared helper ioam6_trace_compute_nodelen() in ioam6.c to\nderive the expected nodelen from the type field, and use it:\n\n  - in ioam6_iptunnel.c (send path, existing validation) to replace\n    the open-coded computation;\n  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose\n    nodelen is inconsistent with the type field, before any data is\n    written.\n\nPer RFC 9197, bits 12-21 are each short (4-octet) fields, so they\nare included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to\n0xff1ffc00).\n\n## Affected\n\n- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < f4d9d4b8fd839719d564651671e24c62c545c23b`\n- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < fb3c662fafebc5b9d74417ed1de8759f6bb72143`\n- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 632d233cf2e64a46865ae2c064ae3c9df7c8864f`\n- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 0591d6509c2ff13f09ea2998434aba0c0472e978`\n- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < e90346a2f1e8917d5760a44a1f61c44e3b36d96b`\n- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < ea3632aefc04205436868541638e26f4a74d5637`\n- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 6db8b56eed62baacaf37486e83378a72635c04cc`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}