CVE-2026-43341

Vulnerability

A critical vulnerability has been discovered in the Linux kernel's IPv6 IOAM (In-situ Operations, Administration, and Maintenance) implementation. The ioam6_fill_trace_data() function stores the schema contribution to the trace length in a u8 variable (sclen). When bit 22 of the IOAM option header is enabled and the largest schema payload is provided, sclen becomes 1 + 1020 / 4 = 256, which wraps to 0 due to the 8-bit overflow. This causes the subsequent remaining-space check to be bypassed, as the wrap leads the check to believe there is still room in the trace buffer [1].

Exploitation

Exploitation

An attacker can exploit this bug a specially crafted IPv6 packet that triggers the IOAM trace mechanism. The attack requires no authentication and can be performed remotely (network proximity is needed). The key prerequisite is enabling bit 22 in the IOAM option header and providing the maximum schema payload, which causes the integer overflow in the sclen field. This overflows the length counter, bypassing the bounds check in __ioam6_fill_trace_data(). The write cursor is then positioned without reserving space, yet the schema header and full payload are still copied, leading to an out-of-bounds write [1].

Impact

A successful exploit can corrupt kernel memory corruption. The out-of-bounds write can potentially lead to arbitrary code execution, denial of service, or information disclosure. Given the CVSS score of 9.8 (Critical) and the ability to trigger remotely, this vulnerability represents a severe threat to systems with the affected kernel in

Mitigation

The issue has been fixed in the Linux kernel stable tree. The patch changes the sclen variable type from u8 to unsigned int to unsigned int` to prevent the integer wraparound [1]. Users are urged to update their kernel to a version containing the fix. No workaround has been publicly identified for a [](source.)