{"uuid": "aadf7310-66fc-4e65-bee6-d9a0a2094465", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43501", "type": "seen", "source": "https://gist.github.com/alon710/5c8955798a6536a1c82d7463f89c3d3e", "content": "# CVE-2026-43501: CVE-2026-43501: Heap Out-of-Bounds Write in Linux Kernel IPv6 RPL Segment Routing Header Processing\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-05-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-43501\n\n## Summary\nA critical heap out-of-bounds (OOB) write vulnerability exists in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) Segment Routing Header (SRH) processing logic. The vulnerability is located within net/ipv6/exthdrs.c, specifically in the ipv6_rpl_srh_rcv function. Under specific circumstances, when a packet containing a compressed RPL Source Routing Header is processed, segment swapping can reduce the common-prefix length, causing the recompressed header to grow. Because the kernel fails to validate available headroom on intermediate segments, a buffer underflow occurs during skb_push. This leads to an integer wrap in the MAC header offset pointer during MAC header rebuilding, causing a 14-byte out-of-bounds memory write roughly 64 KiB past the socket buffer.\n\n## TL;DR\nUnauthenticated remote heap out-of-bounds write in Linux kernel IPv6 RPL SRH processing due to insufficient headroom validation, leading to potential remote code execution or system crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-787 (Primary), CWE-131 (Secondary)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00595\n- **EPSS Percentile**: 45.08%\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Linux Kernel 5.7.x - 5.10.x\n- Linux Kernel 5.11.x - 5.15.x\n- Linux Kernel 5.16.x - 6.1.x\n- Linux Kernel 6.2.x - 6.6.x\n- Linux Kernel 6.7.x - 6.12.x\n- Linux Kernel 6.13.x - 6.18.x\n- Linux Kernel 6.19.x - 7.0.x\n\n## Mitigation\n\n- Apply kernel security updates to fixed versions\n- Deploy ip6tables/nftables rules to drop Routing Header Type 3 packets\n\n**Remediation Steps:**\n1. Identify affected Linux kernel versions running in the infrastructure\n2. Schedule maintenance windows to apply kernel updates\n3. Reboot systems into the patched kernel version\n4. Verify mitigation using network packet filters if patching is delayed\n\n## References\n\n- [Linux Kernel Stable Commit 0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402](https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402)\n- [Linux Kernel Stable Commit 4babc2d9fda2df43823b85d08a0180b68f1b0854](https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854)\n- [Linux Kernel Stable Commit 7398ebefbfd4f8a31d4f665a4213302fa995494b](https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b)\n- [Linux Kernel Stable Commit 8e8be63465a5e80394c70324603dfea1bfdad48f](https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f)\n- [Linux Kernel Stable Commit 9e6bf146b55999a095bb14f73a843942456d1adc](https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc)\n- [Linux Kernel Stable Commit bde199c72d319a4e207f88daabc888317504e2fb](https://git.kernel.org/stable/c/bde199c72d319a4e207f88daabc888317504e2fb)\n- [Linux Kernel Stable Commit be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e](https://git.kernel.org/stable/c/be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e)\n- [Linux Kernel Stable Commit c261d07a80576dc8ccf394ef8f074f8c67a06b37](https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37)\n- [Red Hat Security Advisory RHSA-2026:25191](https://access.redhat.com/errata/RHSA-2026:25191)\n- [Red Hat Security Advisory RHSA-2026:25217](https://access.redhat.com/errata/RHSA-2026:25217)\n- [Red Hat Security Advisory RHSA-2026:27713](https://access.redhat.com/errata/RHSA-2026:27713)\n- [Red Hat Security Advisory RHSA-2026:27731](https://access.redhat.com/errata/RHSA-2026:27731)\n- [Red Hat Security Advisory RHSA-2026:33900](https://access.redhat.com/errata/RHSA-2026:33900)\n- [Red Hat Security Advisory RHSA-2026:34094](https://access.redhat.com/errata/RHSA-2026:34094)\n- [Red Hat Security Advisory RHSA-2026:34095](https://access.redhat.com/errata/RHSA-2026:34095)\n- [Red Hat Security Portal for CVE-2026-43501](https://access.redhat.com/security/cve/CVE-2026-43501)\n- [Red Hat Bugzilla Bug 2480457](https://bugzilla.redhat.com/show_bug.cgi?id=2480457)\n- [Red Hat CSAF VEX for CVE-2026-43501](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43501.json)\n- [Linux Torvalds Commit Patch](https://github.com/torvalds/linux/commit/c261d07a80576dc8ccf394ef8f074f8c67a06b37.patch)\n- [Wiz Vulnerability Database entry for CVE-2026-43501](https://www.wiz.io/vulnerability-database/cve/cve-2026-43501)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-43501) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T14:32:11.859930Z"}