net/ipv6: ioam6: prevent schema length wraparound in trace fill
Published May 8, 2026
9.8
CRITICALCVSS 3.1
EPSS 0.77%
Description
ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer.
Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 5.15StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<5.15
- Version 5.15.210StatusunaffectedConstraints<=5.15.*
- Version 6.1.168StatusunaffectedConstraints<=6.1.*
- Version 6.12.81StatusunaffectedConstraints<=6.12.*
- Version 6.18.22StatusunaffectedConstraints<=6.18.*
- Version 6.19.12StatusunaffectedConstraints<=6.19.*
- Version 6.6.134StatusunaffectedConstraints<=6.6.*
- Version 7.0StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| ||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
- ≥ 5.15 · < 6.1.168
- ≥ 6.2 · < 6.6.134
- ≥ 6.7 · < 6.12.81
- ≥ 6.13 · < 6.18.22
- ≥ 6.19 · < 6.19.12
- 7.0
- 7.0
- 7.0
- 7.0
- 7.0
- 7.0
- 7.0
No data.
Red Hat Enterprise Linux 10
kernel-0:6.12.0-211.31.1.el10_2
Fixed · RHSA-2026:36541
Red Hat Enterprise Linux 10.0 Extended Update Support
kernel-0:6.12.0-55.84.1.el10_0
Fixed · RHSA-2026:33215
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Not affected
Red Hat Enterprise Linux 9
kernel-rt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel-0:6.12.0-211.31.1.el10_2 | Fixed | RHSA-2026:36541 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel-0:6.12.0-55.84.1.el10_0 | Fixed | RHSA-2026:33215 |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
An IPv6 IOAM trace buffer overflow can occur because the schema length contribution is stored in an 8 bit value. With bit 22 enabled and the largest schema payload, sclen wraps from 256 to 0, bypassing the remaining space check while the code still copies the schema header and payload past the trace buffer. The issue is network reachable, although practical exposure is usually limited to IOAM enabled domains or trusted IPv6 networks rather than the public Internet. Impact is kernel memory corruption through an out of bounds write and may cause denial of service or in worst case confidentiality and integrity impact. For the Red Hat Enterprise Linux before 10 is not actual, because not introduced yet (the Fixes patch 8c6f6fa6772696be0c047a711858084b38763728 not applied yet).
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (12)
- https://access.redhat.com/security/cve/CVE-2026-43341 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2468097 Issue Tracking
- https://git.kernel.org/stable/c/184d2e9db27c0f76226b5cad16fe29510a5d2280 Patch
- https://git.kernel.org/stable/c/5e67ba9bb531e1ec6599a82a065dea9040b9ce50 Patch
- https://git.kernel.org/stable/c/77695a69baca9b99d95fad09fc78c2318736604f Patch
- https://git.kernel.org/stable/c/d1b041080086e91d3733a5438a8c51ad5d3d8e09 Patch
- https://git.kernel.org/stable/c/d3a1fb2ca323d7a4e10ab3afbfa25e6d8921e4f2
- https://git.kernel.org/stable/c/d6e1c9b02d85a4f1f4ba6d68e916d9b610a3ed7d Patch
- https://git.kernel.org/stable/c/e96d48b37708d53cbdc47f6f60b0714fc4a5f596 Patch
- https://lore.kernel.org/linux-cve-announce/2026050824-CVE-2026-43341-7c3e@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2026-43341
- https://www.cve.org/CVERecord?id=CVE-2026-43341
Change history (0)
No recorded changes yet.