CVE-2026-43037

The ip4ip6_err() function calls icmp_send() on a cloned packet (skb) whose cb[] field was previously populated by the IPv6 receive path with an inet6_skb_parm structure. The icmp_send() function passes the IPCB(skb2) macro to __ip_options_echo(), which interprets the same cb[] area as an inet_skb_parm structure (IPv4). Because the layouts of both structures differ, the inet6_skb_parm.nhoff field at offset 14 overlaps with inet_skb_parm.opt.rr, assigning it a non-zero value. Consequently, __ip_options_echo() reads the optlen value from the packet data controlled by the attacker (sptr[rr+1]) and copies the corresponding number of bytes to the dopt->__data buffer on the stack, which has a fixed size of 40 bytes (IP_OPTIONS_DATA_FIXED_SIZE). The fix involves zeroing skb2->cb[] before passing the packet and adding minimal IPv4 header validation (version == 4, ihl >= 5).

A remote, unauthenticated attacker can overflow a stack buffer in the Linux kernel, which may lead to arbitrary code execution in kernel space (RCE), and thus to complete system takeover, loss of confidentiality, integrity, and data availability.

Patches available from the vendor should be applied in accordance with the references — fixes have been published in the kernel.org repository at the addresses indicated in the CVE references section. It is recommended to update the kernel as soon as possible to a version containing the described patches.

Linux Kernel — specific versions indicated in the vendor references (patch commits available in the kernel.org repository)