CVE-2026-43341
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
net/ipv6: ioam6: prevent schema length wraparound in trace fill
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer. Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8c6f6fa6772696be0c047a711858084b38763728 | affected | git | d3a1fb2ca323d7a4e10ab3afbfa25e6d8921e4f2 | Unavailable | None listed |
| 8c6f6fa6772696be0c047a711858084b38763728 | affected | git | e96d48b37708d53cbdc47f6f60b0714fc4a5f596 | Unavailable | None listed |
| 8c6f6fa6772696be0c047a711858084b38763728 | affected | git | d1b041080086e91d3733a5438a8c51ad5d3d8e09 | Unavailable | None listed |
| 8c6f6fa6772696be0c047a711858084b38763728 | affected | git | 77695a69baca9b99d95fad09fc78c2318736604f | Unavailable | None listed |
| 8c6f6fa6772696be0c047a711858084b38763728 | affected | git | 184d2e9db27c0f76226b5cad16fe29510a5d2280 | Unavailable | None listed |
| 8c6f6fa6772696be0c047a711858084b38763728 | affected | git | d6e1c9b02d85a4f1f4ba6d68e916d9b610a3ed7d | Unavailable | None listed |
| 8c6f6fa6772696be0c047a711858084b38763728 | affected | git | 5e67ba9bb531e1ec6599a82a065dea9040b9ce50 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.15 | Unavailable | None listed |
| 5.15.210 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.168 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.134 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.81 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.22 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.12 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0 | unaffected | original_commit_for_fix | Unavailable | * | None listed |