CVE-2026-43501

The ipv6_rpl_srh_rcv() function decompresses the SRH header, replaces the next segment in the ipv6_hdr->daddr field, then recompresses the header and pushes it along with the IPv6 header. The recompressed header can be larger than the received one (even by +8 bytes) when the replacement reduces the common prefix length. The pskb_expand_head() call was conditional on segments_left == 0, so for earlier segments the push operation consumed unverified headroom. When skb_push() leaves less than skb->mac_len bytes before the data, the mac_header field (u16 type) overflows to a value around ~65530, and the subsequent memmove() call writes mac_len bytes approximately 64 KiB past the skb->head pointer — which KASAN detects as a 14-byte OOB write in ipv6_rthdr_rcv.

An attacker can cause out-of-bounds write of data in kernel memory, potentially leading to memory corruption, privilege escalation, or remote code execution (RCE) in the kernel context of the operating system.

Patches available from the manufacturer should be applied according to the references — fix commits available at: 4babc2d9fda2, 7398ebefbfd4, 8e8be63465a5, 9e6bf146b559, c261d07a8057 in the git.kernel.org/stable repository. It is recommended to update the kernel to a version containing the indicated patches. As a workaround, you may consider disabling IPv6 RPL routing support if this feature is not required in your environment.

Linux kernel with IPv6 RPL Source Routing support (ipv6_rpl_srh_rcv); exact versions indicated in manufacturer references (commits available in the stable git.kernel.org repository)