Intel

CVE-2026-43501

Kernel Live Patch Security Notice

criticalPoCEPSS 0.6%

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompressed header can be larger than the received one when the swap reduces the common-prefix length the segments share with daddr (CmprI=0, CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes). pskb_expand_head() was gated on segments_left == 0, so on earlier segments the push consumed unchecked headroom. Once skb_push() leaves fewer than skb->mac_len bytes in front of data, skb_mac_header_rebuild()'s call to: skb_set_mac_header(skb, -skb->mac_len); will store (data - head) - mac_len into the u16 mac_header field, which wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB past skb->head. A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv. Fix this by expanding the head whenever the remaining room is less than the push size plus mac_len, and request that much extra so the rebuilt MAC header fits afterwards.

Source: UBUNTU_USNUBUNTU_USNUBUNTU_USNSIEMENS_ADVISORYUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNBSIBSI_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNMSRCCVELISTV5NVDCVEORGEUVD

Metrics

Severity
critical
Priority score
238.98
KEV status
—
Exploit maturity
PoC (publicly reported)
XIEM Effective CVSS
9.8
Source: cna-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
48.1 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-27 10:07 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-08 09:18 UTC· 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/43xxx/CVE-2026-43501.json">CVE-2026-43501</a>
    • Reference: https://cert-portal.siemens.com/productcert/html/ssa-019113.html
  2. CVE Modified2026-09-08 09:18 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Reference: https://access.redhat.com/errata/RHSA-2026:25191
    • Reference: https://access.redhat.com/errata/RHSA-2026:25217
    • Reference: https://access.redhat.com/errata/RHSA-2026:27713
    • Reference: https://access.redhat.com/errata/RHSA-2026:27731
  3. CVE Modified2026-09-08 09:18 UTC· 416baaa9-dc9f-4396-8d5f-8c081fb06d67
    • Reference: https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402
    • Reference: https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854
    • Reference: https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b
    • Reference: https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f
  4. CVE Translated2026-07-23 16:10 UTC· nvd@nist.gov
    • Translation: Title: el kernel de Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ipv6: rpl: reservar espacio libre (headroom) para mac_len cuando el SRH recomprimido crece ipv6_rpl_srh_rcv() descomprime un encabezado de enrutamiento de origen (Source Routing Header) RFC 6554, intercambia el siguiente segmento en ipv6_hdr->daddr, recomprime, luego extrae el encabezado antiguo y empuja el nuevo más el encabezado IPv6 de vuelta. El encabezado recomprimido puede ser más grande que el recibido cuando el intercambio reduce la longitud del prefijo común que los segmentos comparten con daddr (CmprI=0, CmprE>0, seg[0][0] != daddr[0] da un máximo de +8 bytes). pskb_expand_head() estaba condicionado a segments_left == 0, así que en segmentos anteriores el empuje consumió espacio libre (headroom) sin verificar. Una vez que skb_push() deja menos de skb->mac_len bytes delante de los datos, la llamada de skb_mac_header_rebuild() a: skb_set_mac_header(skb, -skb->mac_len); almacenará (data - head) - mac_len en el campo u16 mac_header, que se ajusta a ~65530, y el siguiente memmove() escribe mac_len bytes ~64KiB más allá de skb->head. Un único paquete AF_INET6/SOCK_RAW/IPV6_HDRINCL sobre lo con un SRH tipo 3 de dos segmentos (CmprI=0, CmprE=15) alcanza un espacio libre (headroom) de 8 después de una pasada; KASAN informa de una escritura OOB de 14 bytes en ipv6_rthdr_rcv. Solucione esto expandiendo el encabezado siempre que el espacio restante sea menor que el tamaño del empuje más mac_len, y solicite esa cantidad extra para que el encabezado MAC reconstruido quepa después.

Affected operating systems

  • linux

    amazon / amazon_linux

  • linux

    ubuntu / awsbionic

  • linux

    ubuntu / awsjammy

  • linux

    ubuntu / awsnoble

  • linux

    ubuntu / awsresolute

  • linux

    ubuntu / awsxenial

  • linux

    ubuntu / aws-6.8jammy

  • linux

    ubuntu / aws-hwexenial

  • linux

    ubuntu / azurejammy

  • linux

    ubuntu / azurenoble

  • linux

    ubuntu / azureresolute

  • linux

    ubuntu / azurexenial

  • linux

    ubuntu / azure-4.15bionic

  • linux

    suse / basesystem_module15

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    debian / debian_linux13.0

  • linux

    suse / development_tools_module15

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux_aus8.4

  • linux

    redhat / enterprise_linux_aus8.6

  • linux

    redhat / enterprise_linux_eus10.0

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • arista

    cloudvision_agni2024.4.0 – 2025.2.2

  • arista

    cloudvision_portal2024.2.0 – 2026.1.0

  • arista

    velocloud_edge4.5.0 – 6.4.1

  • arista

    velocloud_gateway

  • arista

    velocloud_orchestrator

  • redhat

    openshift_container_platform4.12 – 4.12.89

  • redhat

    openshift_container_platform4.13 – 4.13.66

  • redhat

    openshift_container_platform4.14 – 4.14.65

  • redhat

    openshift_container_platform4.15 – 4.15.64

  • redhat

    openshift_container_platform4.16 – 4.16.61

  • redhat

    openshift_container_platform4.17 – 4.17.53

  • redhat

    openshift_container_platform4.18 – 4.18.40

  • redhat

    openshift_container_platform4.19 – 4.19.30

  • redhat

    openshift_container_platform4.20 – 4.20.21

  • redhat

    openshift_container_platform4.21 – 4.21.14

  • redhat

    openshift_container_platform

  • siemens

    simatic_ax_runtime

  • suse

    caas_platform

  • suse

    enterprise_storage

  • suse

    manager_proxy

  • suse

    manager_retail_branch_server

  • suse

    manager_server

  • suse

    openstack_cloud

  • suse

    openstack_cloud_crowbar

References & sources

Linked CVEs

Show 9 more CVEs
IDCVE-2026-43501