IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
9.8Crítica

CVE-2026-43037ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Linux Linux; Red Hat NVIDIA for RHEL 10; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support Publicada: (hace 6 meses)

Descripción

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

Debilidad (CWE): CWE-843CWE-121CWE-787

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
enterprise linux 8 —
enterprise linux nvidia 10 —
Linux Linux 2.6.22
linux linux kernel 2.6.22 – < 5.10.253
openshift 4.12 —
openshift 4.13 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.17 —
openshift 4.18 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
openshift 4.22 —
Red Hat NVIDIA for RHEL 10 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION all versions
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support all versions
Red Hat Red Hat OpenShift Container Platform 4.12 all versions
Red Hat Red Hat OpenShift Container Platform 4.13 all versions
Red Hat Red Hat OpenShift Container Platform 4.14 all versions
Red Hat Red Hat OpenShift Container Platform 4.15 all versions
Red Hat Red Hat OpenShift Container Platform 4.16 all versions
Red Hat Red Hat OpenShift Container Platform 4.17 all versions
Red Hat Red Hat OpenShift Container Platform 4.18 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat Red Hat OpenShift Container Platform 4.20 all versions
Red Hat Red Hat OpenShift Container Platform 4.21 all versions
Red Hat Red Hat OpenShift Container Platform 4.22 all versions
rhel e4s 9.2 —

Referencias y parches

Coincidencias CPE (NVD) (13)
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 2.6.22 < 5.10.253
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.11 < 5.15.203
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.16 < 6.1.168
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.2 < 6.6.134
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.7 < 6.12.81
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.13 < 6.18.22
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.19 < 6.19.12
  • cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*

CVE recientes del mismo producto — Linux kernel

Sin puntuación
CVE-2026-99285

netfilter: nft_byteorder: remove multi-register support

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_byteorder: remove multi-register support 64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps …

Sin puntuación
CVE-2026-99284

net: skbuff: propagate shared-frag marker in skb_zerocopy()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(fro…

Sin puntuación
CVE-2026-99279

ksmbd: reclaim ended sessions on logoff and expiration

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expiration LOGOFF and previous-session replacement leave sessions Expired with a zero credential expiry. Ended sessions can retain their memory a…

Sin puntuación
CVE-2026-99282

net/sched: sch_teql: fix use-after-free on lower qdisc drop

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes t…