CVE-2026-43186: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43186 Overview

CVE-2026-43186 is a heap buffer overflow vulnerability in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM) implementation. The flaw resides in the __ioam6_fill_trace_data() function on the receive path. The function trusts the trace->nodelen field from incoming packets without validating it against the trace->type field that defines which data items are present. A crafted packet sets nodelen=0 while enabling type bits 0-21, causing roughly 100 bytes to be written past the allocated region into skb_shared_info. This corrupts adjacent heap memory and triggers a kernel panic.

Critical Impact
A remote attacker can send a crafted IPv6 packet with malformed IOAM trace headers to corrupt kernel heap memory and cause a denial-of-service kernel panic on affected Linux systems.

Affected Products

Linux kernel versions with IPv6 IOAM trace data processing in net/ipv6/exthdrs.c
Linux kernel branches receiving stable backports referenced in patches 0591d65, 632d233, 6db8b56, e90346a, ea3632a, f4d9d4b, and fb3c662
Linux distributions that ship the affected kernel versions and have IPv6 IOAM enabled

Discovery Timeline

2026-05-06 - CVE-2026-43186 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43186

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the kernel's IPv6 IOAM trace data handler. IOAM allows nodes along an IPv6 path to embed operational telemetry into packet headers as defined by RFC 9197. Each transit node appends data based on the type bitmask, while nodelen declares how many 4-octet words each node will write.

On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to compute how much data to write per node. The function does not verify that nodelen matches the size implied by the bits set in trace->type. An attacker can send a packet with nodelen=0 and type bits 0-21 enabled. The kernel allocates a buffer sized for zero data per node, then writes the full set of type-driven fields, overflowing approximately 100 bytes into the adjacent skb_shared_info structure.

Root Cause

The root cause is missing input validation between two related fields in the IOAM trace header. The send path in ioam6_iptunnel.c already computes the expected length, but the receive path in exthdrs.c (ipv6_hop_ioam) accepted attacker-controlled values without cross-checking. The fix introduces a shared helper, ioam6_trace_compute_nodelen(), in ioam6.c that derives the correct nodelen from the type field. The receive path uses this helper to drop inconsistent packets before any data is written. The patch also corrects IOAM6_MASK_SHORT_FIELDS from 0xff100000 to 0xff1ffc00 so that bits 12-21, which are 4-octet short fields per RFC 9197, are correctly classified.

Attack Vector

An attacker sends a malicious IPv6 packet containing an IOAM Hop-by-Hop option to a target system that processes IOAM. The packet sets the type field with bits 0-21 enabled while declaring nodelen=0. When the kernel calls __ioam6_fill_trace_data() on the receive path, the mismatch causes the kernel to write past the allocated buffer into skb_shared_info, corrupting heap structures and panicking the kernel. The exploitation pattern is described in the upstream patches; see the Kernel Patch ea3632a for the receive-path fix.

Detection Methods for CVE-2026-43186

Indicators of Compromise

Unexpected kernel panics or oops messages referencing __ioam6_fill_trace_data, ipv6_hop_ioam, or skb_shared_info corruption.
Kernel logs reporting slab/heap corruption coinciding with IPv6 traffic on interfaces processing Hop-by-Hop options.
Inbound IPv6 packets containing IOAM Pre-allocated Trace options where nodelen=0 but multiple type bits are set.

Detection Strategies

Inspect IPv6 Hop-by-Hop traffic for IOAM trace headers and flag packets where the declared nodelen does not match the bit count of the type field.
Monitor kernel ring buffer (dmesg) and /var/log/messages for stack traces involving IOAM symbols.
Use network telemetry to baseline IOAM usage; environments that do not deploy IOAM should treat any IOAM Hop-by-Hop option as suspicious.

Monitoring Recommendations

Enable kernel hardening options such as CONFIG_SLAB_FREELIST_HARDENED and CONFIG_FORTIFY_SOURCE to surface heap corruption earlier.
Forward kernel crash dumps and kdump artifacts to centralized logging for forensic review.
Track unplanned reboots and kernel panic counts on IPv6-facing systems and alert on anomalies.

How to Mitigate CVE-2026-43186

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce ioam6_trace_compute_nodelen() and validate nodelen against type on the receive path.
Upgrade to a kernel build that includes the fixes referenced in commits 0591d65, 632d233, 6db8b56, e90346a, ea3632a, f4d9d4b, and fb3c662.
If IOAM is not required, disable or filter IPv6 Hop-by-Hop IOAM options at the network edge.

Patch Information

The fix is distributed across multiple stable kernel commits. See the upstream references: Kernel Patch 0591d65, Kernel Patch 632d233, Kernel Patch 6db8b56, Kernel Patch e90346a, Kernel Patch ea3632a, Kernel Patch f4d9d4b, and Kernel Patch fb3c662. Track your distribution's security advisories for vendor-specific kernel updates.

Workarounds

Drop IPv6 packets with IOAM Hop-by-Hop options at the perimeter using firewall or eBPF/XDP filters until kernels are patched.
Disable IPv6 on hosts that do not require it, removing exposure to the affected receive path.
Restrict trust boundaries so that only authenticated, validated network segments can deliver IPv6 Hop-by-Hop options to Linux hosts.

bash

# Example: drop inbound IPv6 Hop-by-Hop traffic with ip6tables until patched
ip6tables -I INPUT -m ipv6header --header hop-by-hop --soft -j DROP

# Verify running kernel includes the IOAM receive-path fix
uname -r
grep -E 'ioam6_trace_compute_nodelen' /proc/kallsyms