---
id: CVE-2026-43042
title: 'mpls: add seqcount to protect the platform_label{,s} pair'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mpls: add seqcount to protect the platform_label{,s} pair

  The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have
  an inconsistent view of platform_labels…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7720c01f3f590116882e251f13c7e1d5602f8643 <
    5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef
  - >-
    Linux >= 7720c01f3f590116882e251f13c7e1d5602f8643 <
    629ec78ef8608d955ce217880cdc3e1873af3a15
  - Linux 4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:13:53.309258Z'
published: '2026-05-01'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:29.711Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43042'
references:
  - url: 'https://git.kernel.org/stable/c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef'
  - url: 'https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15'
tags:
  - cve.org
epss: 0.00156
epssPercentile: 0.04334
ingestedAt: '2026-10-16T17:24:46.678Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mpls: add seqcount to protect the platform_label{,s} pair

The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have
an inconsistent view of platform_labels vs platform_label in case of a
concurrent resize (resize_platform_label_table, under
platform_mutex). This can lead to OOB accesses.

This patch adds a seqcount, so that we get a consistent snapshot.

Note that mpls_label_ok is also susceptible to this, so the check
against RTA_DST in rtm_to_route_config, done outside platform_mutex,
is not sufficient. This value gets passed to mpls_label_ok once more
in both mpls_route_add and mpls_route_del, so there is no issue, but
that additional check must not be removed.

## Affected

- `Linux >= 7720c01f3f590116882e251f13c7e1d5602f8643 < 5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef`
- `Linux >= 7720c01f3f590116882e251f13c7e1d5602f8643 < 629ec78ef8608d955ce217880cdc3e1873af3a15`
- `Linux 4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.