CVE-2026-43341 net/ipv6: ioam6: prevent schema length wraparound in trace fill
An integer overflow in the Linux kernel IPv6 IOAM module allows buffer overflows, potentially enabling local privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43341?
CVE-2026-43341 is a critical vulnerability in Linux kernel, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/ipv6: ioam6: prevent schema length wraparound in trace fill
ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer.
Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.
Weakness: CWE-190
Which versions are affected by CVE-2026-43341?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43341?
Apply the vendor's patch.
Is CVE-2026-43341 being exploited?
There is no known exploitation of CVE-2026-43341 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43341, DEBIAN-CVE-2026-43341, GHSA-p877-m7m5-3qh3, ROOT-OS-UBUNTU-2204-CVE-2026-43341, ROOT-OS-UBUNTU-2404-CVE-2026-43341, UBUNTU-CVE-2026-43341.