Linux Kernel: IPv6/IPv4 Tunnel Bug Enables Buffer Overwrite
CVE-2026-43037 Published on May 1, 2026

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

NVD

Vulnerability Analysis

CVE-2026-43037 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

What is an Object Type Confusion Vulnerability?

The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

CVE-2026-43037 has been classified to as an Object Type Confusion vulnerability or weakness.

Products Associated with CVE-2026-43037

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-43037 are published in these products:

Linux Kernel

Red Hat Enterprise Linux Nvidia

Red Hat Rhel Els

Red Hat Openshift

Red Hat Enterprise Linux Eus

Red Hat Enterprise Linux (RHEL)

Red Hat Rhel E4s

Red Hat Rhel Eus

Red Hat Rhel Aus

Red Hat Rhel Eus Long Life

Red Hat Rhel Tus

Canonical Ubuntu Linux

Red Hat Rhel Extras Rt Els

Affected Versions

Linux:

Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below ea9f65b27c8404e164848ebff1443310fd187629 is affected.
Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below d6621f60192fe10c047a4487be42a6f4c150707f is affected.
Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below 2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5 is affected.
Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below a0c4ce9900a108eaf55d0f3b399cb55999647d39 is affected.
Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below 1063515ce15ff31065c4e7f8265f4c2fd3c54876 is affected.
Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below 590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3 is affected.
Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below 4a622658f384b03560834cbe8ffcfe69a278f7c8 is affected.
Version c4d3efafcc933fd2ffd169d7dc4f980393a13796 and below 2edfa31769a4add828a7e604b21cb82aaaa05925 is affected.

Linux:

Version 2.6.22 is affected.
Before 2.6.22 is unaffected.
Version 5.10.253, <= 5.10.* is unaffected.
Version 5.15.203, <= 5.15.* is unaffected.
Version 6.1.168, <= 6.1.* is unaffected.
Version 6.6.134, <= 6.6.* is unaffected.
Version 6.12.81, <= 6.12.* is unaffected.
Version 6.18.22, <= 6.18.* is unaffected.
Version 6.19.12, <= 6.19.* is unaffected.
Version 7.0, <= * is unaffected.

Red Hat NVIDIA for RHEL 10:

Version 0:6.12.0-212.10.el10nv and below * is unaffected.
Version 0:6.12.0-231.12.el10nv and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:6.12.0-211.22.1.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:6.12.0-55.77.1.el10_0 and below * is unaffected.

Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION:

Version 0:2.6.32-754.61.1.el6 and below * is unaffected.

Red Hat Enterprise Linux 7 Extended Lifecycle Support:

Version 0:3.10.0-1160.155.1.rt56.1307.el7 and below * is unaffected.

Red Hat Enterprise Linux 7 Extended Lifecycle Support:

Version 0:3.10.0-1160.153.1.el7 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.18.0-553.132.1.rt7.473.el8_10 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.18.0-553.132.1.el8_10 and below * is unaffected.

Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:4.18.0-305.194.1.el8_4 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:4.18.0-305.194.1.el8_4 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:

Version 0:4.18.0-372.195.1.el8_6 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On:

Version 0:4.18.0-372.195.1.el8_6 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:4.18.0-477.145.1.el8_8 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:4.18.0-477.145.1.el8_8 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9:

Version 0:5.14.0-687.15.1.el9_8 and below * is unaffected.

Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:5.14.0-284.174.1.el9_2 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:5.14.0-284.174.1.rt14.459.el9_2 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions:

Version 0:5.14.0-427.129.1.el9_4 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:5.14.0-570.119.1.el9_6 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat OpenShift Container Platform 4.12:

Version 412.86.202606140301-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.13:

Version 413.92.202606160406-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.14:

Version 414.92.202606231112-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.15:

Version 415.92.202606200237-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.17:

Version 417.94.202606250942-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.18:

Version 418.94.202606051320-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 4.19.9.6.202606100451-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 4.20.9.6.202606101223-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 4.21.9.6.202606101139-0 and below * is unaffected.

Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 9:

Exploit Probability

EPSS

0.51%

Percentile

39.63%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

Linux Kernel: IPv6/IPv4 Tunnel Bug Enables Buffer OverwriteCVE-2026-43037 Published on May 1, 2026

Vulnerability Analysis

Weakness Type

What is an Object Type Confusion Vulnerability?

Products Associated with CVE-2026-43037

Affected Versions

Exploit Probability

Linux Kernel: IPv6/IPv4 Tunnel Bug Enables Buffer Overwrite
CVE-2026-43037 Published on May 1, 2026