CVE-2026-43083

Vulnerability

Description

The vulnerability resides in the __ioam6_fill_trace_data() function in the Linux kernel's ioam6 (IPv6 Operations, Administration, and Maintenance) module. When trace->type.bit6 is set, the code calls skb_get_tx_queue(dev, skb) to retrieve the transmit queue. However, on the RX path, skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device has TX queues, skb_get_queue_mapping() returns an index exceeding dev->num_tx_queues, leading to an out-of-bounds (OOB) access of the dev->_tx[] array. Additionally, the function lacks proper locking around qdisc_qstats_qlen_backlog(), which is called from both softirq and process contexts without protection.

Attack

Surface and Exploitation

An attacker can exploit this by sending a specially crafted IPv6 packet with ioam6 options that cause trace->type.bit6 to be set while the packet is being processed on the RX path. The vulnerability is triggerable from an unprivileged network position, as no special authentication is required to send such packets. The bug can be triggered in both softirq (RX) and process contexts, making it accessible to remote attackers.

Impact

Successful exploitation of the OOB access can result in memory corruption, potentially leading to system crashes (denial of service) or, in worst-case scenarios, privilege escalation. The missing locking vulnerability could cause data corruption due to concurrent access to shared data structures, further destabilizing the system.

Mitigation

The Linux kernel community has released patches that fix the vulnerability by adding a check to prevent the OOB access and by properly acquiring a spin lock (spin_lock_bh()) before calling qdisc_qstats_qlen_backlog(). These patches have been backported to stable kernel branches, as referenced in commits [1], [2], and [3]. Users are advised to update their kernels to the latest stable versions containing these fixes. No workarounds are known.