CVE-2026-43038 Overview
CVE-2026-43038 is a Linux kernel vulnerability in the IPv6 ICMP error-handling path. The flaw exists in ip6_err_gen_icmpv6_unreach(), which fails to clear skb2->cb[] before passing the cloned socket buffer to icmp6_send(). Because the outer packet is an IPv4 ICMP error, the control buffer holds an inet_skb_parm structure that is later reinterpreted as an inet6_skb_parm via the IP6CB() macro. The CIPSO offset field overlaps with the dsthao field at offset 18, allowing an attacker-controlled value to influence subsequent TLV parsing in mip6_addr_swap().
Critical Impact
A remote attacker sending a forged ICMPv4 error containing a CIPSO IP option can trigger out-of-bounds reads and a 16-byte memory swap that may extend into skb_shared_info, leading to memory corruption or kernel information disclosure.
Affected Products
- Linux kernel (mainline) versions containing ip6_err_gen_icmpv6_unreach() prior to the referenced fix commits
- Linux kernel stable branches receiving backports identified by commits 0452b652, 1ceeebd5, 3d5127d9, 86ab3e55, a2edbb63, a4437faf, c438ba01, and e41953e7
- Distributions shipping vulnerable kernel builds with IPv6 and CIPSO/IPsec mobility support enabled
Discovery Timeline
- 2026-05-01 - CVE-2026-43038 published to NVD
- 2026-05-03 - Last updated in NVD database
Technical Details for CVE-2026-43038
Vulnerability Analysis
The vulnerability resides in the IPv6 ICMP unreachable generation path. When an IPv4 ICMP error packet carrying an inner IPv6 datagram reaches ip6_err_gen_icmpv6_unreach(), the kernel clones the skb into skb2 and forwards it to icmp6_send(). The clone inherits the original control buffer contents, which were populated as an IPv4 inet_skb_parm structure.
Downstream code accesses the control buffer through the IP6CB() macro, which casts the same memory region to inet6_skb_parm. The cipso offset field of the IPv4 structure overlaps with the dsthao field of the IPv6 structure at byte offset 18. An attacker who places a CIPSO IP option in the outer IPv4 header can therefore set dsthao to an arbitrary non-zero value without ever sending an IPv6 destination options header.
Inside icmp6_send(), mip6_addr_swap() calls ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO) to locate a Home Address Option. Parsing begins at the attacker-supplied offset against the inner IPv6 packet. If a forged TLV is matched without verifying that the remaining packet length covers the full 18-byte struct ipv6_destopt_hao, the subsequent 16-byte address swap can read and write past the packet payload into skb_shared_info.
Root Cause
The root cause is missing initialization of skb2->cb[] after cloning. The IPv4 control-buffer state leaks into IPv6 processing and is reinterpreted under a different structure layout, producing type confusion between inet_skb_parm and inet6_skb_parm.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker sends a crafted ICMPv4 error message that encapsulates an IPv6 datagram and includes a CIPSO IP option in the outer header. Reaching the vulnerable path requires no local access or user interaction, and the resulting out-of-bounds memory access may corrupt adjacent kernel memory or expose contents of skb_shared_info.
No public proof-of-concept code is referenced in the advisory. See the Linux Kernel Commit a4437faf for the upstream fix that clears the control buffer.
Detection Methods for CVE-2026-43038
Indicators of Compromise
- Inbound ICMPv4 unreachable packets that contain a CIPSO IP option and encapsulate IPv6 payloads, particularly from untrusted sources
- Kernel oops, slab corruption, or skb_shared_info warnings originating in icmp6_send() or mip6_addr_swap()
- Unexpected IPv6 ICMP error generation correlated with malformed inbound IPv4 ICMP traffic
Detection Strategies
- Inspect kernel logs (dmesg, journalctl -k) for stack traces referencing ip6_err_gen_icmpv6_unreach, icmp6_send, mip6_addr_swap, or ipv6_find_tlv
- Monitor network telemetry for ICMPv4 type 3 messages carrying IP options, which are uncommon in modern environments
- Compare running kernel versions and build IDs against vendor advisories tied to the listed upstream fix commits
Monitoring Recommendations
- Forward kernel and network logs into a centralized analytics platform to correlate crashes with suspicious ICMP traffic patterns
- Alert on repeated kernel panics or soft lockups on Linux hosts exposed to the public internet or untrusted networks
- Track patch state across the Linux fleet and flag hosts running kernels predating the upstream fix commits
How to Mitigate CVE-2026-43038
Immediate Actions Required
- Update affected Linux kernels to a release that includes the upstream fix clearing skb2->cb[] in ip6_err_gen_icmpv6_unreach()
- Apply distribution security updates as soon as vendor-backported packages become available for the kernel branches in use
- Reboot patched systems to ensure the fixed kernel is active in memory
Patch Information
The fix is committed across multiple Linux stable branches. Reference commits include Linux Kernel Commit a4437faf, Linux Kernel Commit 0452b65, Linux Kernel Commit 1ceeebd5, Linux Kernel Commit 3d5127d9, Linux Kernel Commit 86ab3e55, Linux Kernel Commit a2edbb63, Linux Kernel Commit c438ba01, and Linux Kernel Commit e41953e7. The patch zeroes the control buffer of the cloned skb so that IPv6 processing does not interpret residual IPv4 metadata.
Workarounds
- Drop or rate-limit untrusted ICMPv4 error packets that include IP options at perimeter firewalls and host-based filters
- Block CIPSO-tagged traffic at network boundaries where it is not operationally required
- Disable IPv6 on hosts that do not need it, reducing the reachable attack surface for ip6_err_gen_icmpv6_unreach()
# Example: drop ICMPv4 packets carrying IP options at the host firewall
iptables -A INPUT -p icmp -m ipv4options --any -j DROP
# Verify kernel version against the fix
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
