Linux Kernel IPv6 RPL SRH Recompression Headroom Overwrite
CVE-2026-43501 Published on May 21, 2026
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back. The
recompressed header can be larger than the received one when the swap
reduces the common-prefix length the segments share with daddr (CmprI=0,
CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).
pskb_expand_head() was gated on segments_left == 0, so on earlier
segments the push consumed unchecked headroom. Once skb_push() leaves
fewer than skb->mac_len bytes in front of data,
skb_mac_header_rebuild()'s call to:
skb_set_mac_header(skb, -skb->mac_len);
will store (data - head) - mac_len into the u16 mac_header field, which
wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB
past skb->head.
A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two
segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one
pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.
Fix this by expanding the head whenever the remaining room is less than
the push size plus mac_len, and request that much extra so the rebuilt
MAC header fits afterwards.
Products Associated with CVE-2026-43501
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and below 8e8be63465a5e80394c70324603dfea1bfdad48f is affected.
- Version 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and below 4babc2d9fda2df43823b85d08a0180b68f1b0854 is affected.
- Version 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and below c261d07a80576dc8ccf394ef8f074f8c67a06b37 is affected.
- Version 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and below 7398ebefbfd4f8a31d4f665a4213302fa995494b is affected.
- Version 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and below 9e6bf146b55999a095bb14f73a843942456d1adc is affected.
- Version 5.7 is affected.
- Before 5.7 is unaffected.
- Version 6.6.140, <= 6.6.* is unaffected.
- Version 6.12.86, <= 6.12.* is unaffected.
- Version 6.18.27, <= 6.18.* is unaffected.
- Version 7.0.4, <= 7.0.* is unaffected.
- Version 7.1-rc2, <= * is unaffected.