CVE-2026-43037 ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Critical 9.8 Published 1 May 2026 Updated 19 Oct 2026

A memory corruption vulnerability in the Linux kernel's IPv6 tunnel error handling allows attackers to execute arbitrary code or cause a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-43037?

CVE-2026-43037 is a critical memory corruption vulnerability in Linux kernel, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Oskar Kjos reported the following problem.

ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).

To fix this we clear skb2->cb[], as suggested by Oskar Kjos.

Also add minimal IPv4 header validation (version == 4, ihl >= 5).

Weakness: CWE-787, CWE-843, CWE-121

Which versions are affected by CVE-2026-43037?

It affects 1 product.

Linux distribution packages (40)

`kpatch-patch-6_12_0-211_16_1` Red Hat:enterprise_linux:10.2	All versions	`0:1-1.el10_2`
`kpatch-patch-6_12_0-211_16_1-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:1-1.el10_2`
`kpatch-patch-6_12_0-211_16_1-debugsource` Red Hat:enterprise_linux:10.2	All versions	`0:1-1.el10_2`
`kpatch-patch-4_18_0-553_109_1` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-4.el8_10`
`kpatch-patch-4_18_0-553_109_1-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-4.el8_10`
`kpatch-patch-4_18_0-553_109_1-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-4.el8_10`
`kpatch-patch-4_18_0-553_125_1` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-1.el8_10`
`kpatch-patch-4_18_0-553_125_1-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-1.el8_10`
`kpatch-patch-4_18_0-553_125_1-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-1.el8_10`
`kpatch-patch-4_18_0-553_53_1` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-11.el8_10`
`kpatch-patch-4_18_0-553_53_1-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-11.el8_10`
`kpatch-patch-4_18_0-553_53_1-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-11.el8_10`
`kpatch-patch-4_18_0-553_72_1` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-8.el8_10`
`kpatch-patch-4_18_0-553_72_1-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-8.el8_10`
`kpatch-patch-4_18_0-553_72_1-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-8.el8_10`
`kpatch-patch-4_18_0-553_85_1` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-6.el8_10`
`kpatch-patch-4_18_0-553_85_1-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-6.el8_10`
`kpatch-patch-4_18_0-553_85_1-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:1-6.el8_10`
`kpatch-patch-5_14_0-687_10_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_8`
`kpatch-patch-5_14_0-687_10_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_8`
`kpatch-patch-5_14_0-687_10_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_8`
`kernel` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-core` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-debug` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-debug-core` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-debug-debuginfo` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-debug-modules` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-debug-modules-core` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-debug-modules-extra` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-debuginfo` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-modules` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-modules-core` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-64k-modules-extra` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-abi-stablelists` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-core` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-debug` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-debug-core` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-debug-debuginfo` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`
`kernel-debug-devel` Red Hat:enterprise_linux_nvidia:10::el10	All versions	`0:6.12.0-212.10.el10nv`

Products include Linux kernel.

How do I fix CVE-2026-43037?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-43037 being exploited?

There is no known exploitation of CVE-2026-43037 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2026-43037, DEBIAN-CVE-2026-43037, GHSA-p2wf-qj6m-x5fg, RHSA-2026:25534, RHSA-2026:28738, RHSA-2026:28740 and 9 more.