CVE-2026-43057: Linux Kernel IPv6 Checksum Vulnerability

CVE-2026-43057 Overview

CVE-2026-43057 is a Linux kernel networking vulnerability in the IPv6 Generic Segmentation Offload (GSO) fallback path. The flaw resides in how the kernel handles tunneled traffic when NETIF_F_IPV6_CSUM checksum offload cannot process packets containing IPv6 extension headers. The existing fallback logic checks the outer network header length, but for tunneled packets the inner header length must be evaluated. Packets such as RFC 6951 SCTP-in-UDP, which lack a standard inner IP protocol, also fail to revert correctly to software GSO. The issue affects Linux kernel 6.17 releases and 7.0 release candidates.

Critical Impact
Remote attackers can trigger a high-availability impact on affected Linux systems by sending crafted tunneled IPv6 traffic, leading to denial-of-service conditions in the kernel networking stack.

Affected Products

Linux Kernel 6.17 (including rc3 through rc7)
Linux Kernel 7.0 release candidates (rc1 through rc5)
Distributions shipping affected upstream stable kernel branches

Discovery Timeline

2026-05-01 - CVE-2026-43057 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43057

Vulnerability Analysis

The vulnerability resides in the Linux kernel's network transmission path that handles IPv6 checksum offload fallback. NETIF_F_IPV6_CSUM advertises hardware checksum offload capability only for IPv6 packets without extension headers. Packets carrying extension headers must fall back to software checksumming, and because TCP Segmentation Offload (TSO) depends on checksum offload, those packets must additionally fall back to GSO.

The original fallback implementation checked only the outer IPv6 network header length when deciding whether to revert to software segmentation. For tunneled packets such as IPv6-in-IPv6 or other encapsulations, the relevant header is the inner network header. Failing to evaluate the inner header length leads to mishandled segmentation decisions when extension headers appear in the inner packet. A second case involves tunneled packets without an inner IP protocol, including RFC 6951 SCTP encapsulated in UDP, which also require the software GSO path.

Root Cause

The defect is an input validation error in the GSO fallback logic. The check used the outer network header length unconditionally, ignoring the encapsulation context required for tunneled traffic processing.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. A remote attacker can send specially crafted tunneled IPv6 traffic containing extension headers, or non-standard encapsulations such as SCTP-in-UDP, to a vulnerable host. The mismatch between the offload capability check and the actual packet structure leads to incorrect segmentation handling, which can degrade or disrupt kernel networking. See the upstream patch series for the corrected header length evaluation.

// No verified proof-of-concept code is publicly available.
// Refer to the upstream commits listed in the references for the
// authoritative description of the fix.

Detection Methods for CVE-2026-43057

Indicators of Compromise

Unexpected kernel warnings or soft lockups in network transmit paths involving IPv6 GSO or TSO functions
Spikes in dropped or malformed tunneled IPv6 packets reported by network interfaces
Anomalous volumes of IPv6 traffic carrying extension headers or SCTP-in-UDP encapsulation directed at Linux hosts

Detection Strategies

Inventory hosts running Linux kernel 6.17 or 7.0 release-candidate builds and confirm patch status against the listed upstream commits
Monitor dmesg and kernel logs for networking subsystem stack traces referencing GSO, TSO, or IPv6 checksum offload code paths
Inspect network telemetry for tunneled IPv6 flows with extension headers from untrusted sources

Monitoring Recommendations

Enable centralized kernel log collection and alert on repeated networking subsystem warnings
Track interface-level counters for transmit errors, dropped packets, and offload-related anomalies
Correlate kernel events with upstream traffic patterns to identify potential exploitation attempts

How to Mitigate CVE-2026-43057

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the official commits as soon as distribution updates become available
Prioritize patching of internet-facing systems and network gateways processing IPv6 or tunneled traffic
Validate that distribution stable trees include the fix before redeploying production kernels

Patch Information

The fix is delivered through a series of upstream kernel commits. Reference the Linux Kernel Commit 2094a7c, Linux Kernel Commit 33670f7, Linux Kernel Commit 732fdeb, Linux Kernel Commit a98b781, Linux Kernel Commit c4336a0, and Linux Kernel Commit ed71cf4 for the authoritative source changes that extend the header length check to inner headers and handle tunneled packets without an inner IP protocol.

Workarounds

Restrict ingress of unsolicited tunneled IPv6 traffic at perimeter firewalls where business requirements allow
Disable IPv6 checksum offload on affected interfaces using ethtool -K <iface> tx-checksum-ipv6 off to force the software path until patches are applied
Limit exposure of hosts processing SCTP-in-UDP or unusual IPv6 encapsulations to trusted network segments

bash

# Configuration example: disable IPv6 TX checksum offload as a temporary mitigation
sudo ethtool -K eth0 tx-checksum-ipv6 off
sudo ethtool -K eth0 tso off gso off