{"id":"CVE-2026-43037","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2->cb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the I…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2->cb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the I…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-787","CWE-843"],"published":"2026-05-01","updated":"2026-06-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43037","references":[{"url":"https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://access.redhat.com/errata/RHSA-2026:22900","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22940","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22964","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23224","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23237","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24343","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25120","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25121","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25181","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25186","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25191","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25193","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25200","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25217","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25533","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25534","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26528","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26535","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26542","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27719","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27729","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28738","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28740","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28741","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28742","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28748","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28749","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28750","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-43037","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464351","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43037.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43037"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43037"},{"url":"https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:33486"},{"url":"https://access.redhat.com/errata/RHSA-2026:41236"},{"url":"https://access.redhat.com/errata/RHSA-2026:28887"},{"url":"https://access.redhat.com/errata/RHSA-2026:28962"},{"url":"https://access.redhat.com/errata/RHSA-2026:25044"},{"url":"https://access.redhat.com/errata/RHSA-2026:34098"},{"url":"https://access.redhat.com/errata/RHSA-2026:44232"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00688,"epssPercentile":0.52508,"ingestedAt":"2026-06-29T13:24:34.833Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS E4S (v.9.4)","affected":["enterprise_linux 9","nvidia_for_rhel 10","enterprise_linux_server_extension_v_6_els_extension","enterprise_linux_server_optional_extension_v_6_els_extension","enterprise_linux_server_v_7_els","enterprise_linux_for_real_time_v_7_els","enterprise_linux_server_optional_v_7_els","openshift_container_platform 4.12","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.16","openshift_container_platform 4.17","openshift_container_platform 4.18","openshift_container_platform 4.19","openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_eus_extension_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8"],"patched":["nvidia_for_rhel 10","enterprise_linux_server_extension_v_6_els_extension","enterprise_linux_server_optional_extension_v_6_els_extension","enterprise_linux_server_v_7_els","enterprise_linux_for_real_time_v_7_els","enterprise_linux_server_optional_v_7_els","openshift_container_platform 4.12","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.16","openshift_container_platform 4.17","openshift_container_platform 4.18","openshift_container_platform 4.19","openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_eus_extension_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_9_6"],"scores":{"nvd":9.8,"vendor":8.8,"cna":9.8},"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:13:48.832750Z"},"slug":"CVE-2026-43037","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2->cb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt->__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2->cb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl >= 5).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:25534** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:25534)\n- **RHSA-2026:33486** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33486)\n- **RHSA-2026:27719** · Red Hat · fixed in: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27719)\n- **RHSA-2026:27729** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27729)\n- **RHSA-2026:41236** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time (v. 7 ELS) · released 2026-07-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:41236)\n- **RHSA-2026:26528** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26528)\n- **RHSA-2026:26542** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26542)\n- **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887)\n- **RHSA-2026:28962** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:28962)\n- **RHSA-2026:25044** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-06-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:25044)\n- **RHSA-2026:34098** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34098)\n- **Red Hat VEX** · Critical · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43037.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}