---
id: CVE-2026-43186
title: 'ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

  On the receive path, __ioam6_fill_trace_data() uses trace->nodelen
  to decide how much data to write f…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    f4d9d4b8fd839719d564651671e24c62c545c23b
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    fb3c662fafebc5b9d74417ed1de8759f6bb72143
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    632d233cf2e64a46865ae2c064ae3c9df7c8864f
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    0591d6509c2ff13f09ea2998434aba0c0472e978
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    e90346a2f1e8917d5760a44a1f61c44e3b36d96b
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    ea3632aefc04205436868541638e26f4a74d5637
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    6db8b56eed62baacaf37486e83378a72635c04cc
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:15:25.722836Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:35.434Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43186'
references:
  - url: 'https://git.kernel.org/stable/c/f4d9d4b8fd839719d564651671e24c62c545c23b'
  - url: 'https://git.kernel.org/stable/c/fb3c662fafebc5b9d74417ed1de8759f6bb72143'
  - url: 'https://git.kernel.org/stable/c/632d233cf2e64a46865ae2c064ae3c9df7c8864f'
  - url: 'https://git.kernel.org/stable/c/0591d6509c2ff13f09ea2998434aba0c0472e978'
  - url: 'https://git.kernel.org/stable/c/e90346a2f1e8917d5760a44a1f61c44e3b36d96b'
  - url: 'https://git.kernel.org/stable/c/ea3632aefc04205436868541638e26f4a74d5637'
  - url: 'https://git.kernel.org/stable/c/6db8b56eed62baacaf37486e83378a72635c04cc'
tags:
  - cve.org
epss: 0.00861
epssPercentile: 0.57763
ingestedAt: '2026-10-16T17:24:46.685Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

On the receive path, __ioam6_fill_trace_data() uses trace->nodelen
to decide how much data to write for each node. It trusts this field
as-is from the incoming packet, with no consistency check against
trace->type (the 24-bit field that tells which data items are
present). A crafted packet can set nodelen=0 while setting type bits
0-21, causing the function to write ~100 bytes past the allocated
region (into skb_shared_info), which corrupts adjacent heap memory
and leads to a kernel panic.

Add a shared helper ioam6_trace_compute_nodelen() in ioam6.c to
derive the expected nodelen from the type field, and use it:

  - in ioam6_iptunnel.c (send path, existing validation) to replace
    the open-coded computation;
  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose
    nodelen is inconsistent with the type field, before any data is
    written.

Per RFC 9197, bits 12-21 are each short (4-octet) fields, so they
are included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to
0xff1ffc00).

## Affected

- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < f4d9d4b8fd839719d564651671e24c62c545c23b`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < fb3c662fafebc5b9d74417ed1de8759f6bb72143`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 632d233cf2e64a46865ae2c064ae3c9df7c8864f`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 0591d6509c2ff13f09ea2998434aba0c0472e978`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < e90346a2f1e8917d5760a44a1f61c44e3b36d96b`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < ea3632aefc04205436868541638e26f4a74d5637`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 6db8b56eed62baacaf37486e83378a72635c04cc`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.