{"schema":"threatline.record/2","record":{"id":"CVE-2026-43501","aliases":[],"summary":"ipv6: rpl: reserve mac_len headroom when recompressed SRH grows","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: reserve mac_len headroom when recompressed SRH grows\n\nipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps\nthe next segment into ipv6_hdr->daddr, recompresses, then pulls the old\nheader and pushes the new one plus the IPv6 header back.  The\nrecompressed header can be larger than the received one when the swap\nreduces the common-prefix length the segments share with daddr (CmprI=0,\nCmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).\n\npskb_expand_head() was gated on segments_left == 0, so on earlier\nsegments the push consumed unchecked headroom.  Once skb_push() leaves\nfewer than skb->mac_len bytes in front of data,\nskb_mac_header_rebuild()'s call to:\n\n\tskb_set_mac_header(skb, -skb->mac_len);\n\nwill store (data - head) - mac_len into the u16 mac_header field, which\nwraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB\npast skb->head.\n\nA single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two\nsegment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one\npass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.\n\nFix this by expanding the head whenever the remaining room is less than\nthe push size plus mac_len, and request that much extra so the rebuilt\nMAC header fits afterwards.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","source_modified_at":"2026-10-19T19:26:38.012Z","fetched_at":"2026-10-26T00:08:39.284423Z","product":"Linux","vendor":"Linux","versions":[{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"bde199c72d319a4e207f88daabc888317504e2fb","status":"affected","versionType":"git"},{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e","status":"affected","versionType":"git"},{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402","status":"affected","versionType":"git"},{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"8e8be63465a5e80394c70324603dfea1bfdad48f","status":"affected","versionType":"git"},{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"4babc2d9fda2df43823b85d08a0180b68f1b0854","status":"affected","versionType":"git"},{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"c261d07a80576dc8ccf394ef8f074f8c67a06b37","status":"affected","versionType":"git"},{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"7398ebefbfd4f8a31d4f665a4213302fa995494b","status":"affected","versionType":"git"},{"version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","lessThan":"9e6bf146b55999a095bb14f73a843942456d1adc","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","source_modified_at":"2026-10-19T19:26:38.012Z","fetched_at":"2026-10-26T00:08:39.284423Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","status":"unaffected","versionType":"semver"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.140","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.86","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.27","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.4","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","source_modified_at":"2026-10-19T19:26:38.012Z","fetched_at":"2026-10-26T00:08:39.284423Z","package":{"name":"Linux","ecosystem":null},"version":"0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","source_modified_at":"2026-10-19T19:26:38.012Z","fetched_at":"2026-10-26T00:08:39.284423Z","package":{"name":"Linux","ecosystem":null},"version":"8e8be63465a5e80394c70324603dfea1bfdad48f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","source_modified_at":"2026-10-19T19:26:38.012Z","fetched_at":"2026-10-26T00:08:39.284423Z","package":{"name":"Linux","ecosystem":null},"version":"4babc2d9fda2df43823b85d08a0180b68f1b0854","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","source_modified_at":"2026-10-19T19:26:38.012Z","fetched_at":"2026-10-26T00:08:39.284423Z","package":{"name":"Linux","ecosystem":null},"version":"7398ebefbfd4f8a31d4f665a4213302fa995494b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","source_modified_at":"2026-10-19T19:26:38.012Z","fetched_at":"2026-10-26T00:08:39.284423Z","package":{"name":"Linux","ecosystem":null},"version":"9e6bf146b55999a095bb14f73a843942456d1adc","basis":"first unaffected version stated in the CVE record"}],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00732,"percentile":0.54044,"score_date":"2026-10-25"},"published_at":"2026-05-21T12:17:49.885Z","modified_at":"2026-10-19T19:26:38.012Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-43501","fetched_at":"2026-10-26T00:08:39.284423Z","source_modified_at":"2026-10-19T19:26:38.012Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43501","fetched_at":"2026-10-26T00:08:39.284423Z","source_modified_at":"2026-10-25"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/bde199c72d319a4e207f88daabc888317504e2fb"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-43501","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480457","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43501.json","tags":["x_sadp-csaf-vex"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:27731","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:25191","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:34095","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:27713","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:34094","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:25217","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:33900","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-16T15:17:51.076901Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T19:26:38.012Z","content_hash":"4ca664fb1ab3e0c655bf409e2c48bde0b27fa79ea78607420fa498ac58c96f5b"}}