CVE-2026-43057

Vulnerability

Description

CVE-2026-43057 is a vulnerability in the Linux kernel's networking stack, specifically in the handling of IPv6 checksum offload (NETIF_F_IPV6_CSUM) during GSO (Generic Segmentation Offload) fallback. The kernel incorrectly checks the network header length instead of the inner header length for tunneled packets when deciding whether to fall back to software checksumming. This occurs because NETIF_F_IPV6_CSUM only supports checksum offload for packets without IPv6 extension headers; packets with extension headers must fall back to software checksumming, and TSO (TCP Segmentation Offload) must revert to GSO. The fallback logic introduced by a prior commit failed to account for tunnel encapsulation, leading to improper handling.

Exploitation

Conditions

An attacker can exploit this vulnerability by sending crafted tunneled IPv6 packets that include extension headers or non-standard inner protocols, such as SCTP encapsulated in UDP (as per RFC 6951). These packets trigger the flawed fallback path because the kernel checks the outer network header length rather than the inner header. No authentication is required; the attacker only needs the ability to send network traffic to a vulnerable system. The attack surface is network-facing, and the vulnerability can be triggered remotely.

Impact

Successful exploitation could lead to incorrect GSO segmentation, potentially causing packet corruption, data loss, or denial of service. The vulnerability is rated High with a CVSS v3 score of 7.5, indicating significant potential for disruption. There is no evidence of privilege escalation or remote code execution; the impact is limited to network-level integrity and availability.

Mitigation

The vulnerability has been patched in the Linux kernel stable tree. The fix extends the fallback check to use the inner header length for tunneled packets, and also handles special cases like SCTP-in-UDP. Patched versions are available via the stable kernel commits referenced below [1][2][3][4]. Users should update their kernels to the latest stable release to mitigate the issue.