CVE-2026-43501

Vulnerability

The vulnerability resides in the ipv6_rpl_srh_rcv() function in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) source routing implementation. When processing an RFC 6554 Source Routing Header (SRH), the function decompresses the header, swaps the next segment into ipv6_hdr->daddr, recompresses it, then pulls the old header and pushes the new one plus the IPv6 header. The recompressed header can grow larger than the original when the common-prefix length (CmprI=0, CmprE>0) is such that the swapped segment does not share the first byte with daddr, adding up to 8 bytes. The function only calls pskb_expand_head() when segments_left == 0, so on earlier segments, the push may consume insufficient headroom, leading to an out-of-bounds write when skb_mac_header_rebuild() tries to set the MAC header. This affects Linux kernel versions prior to the patch, across stable trees [1][2][3][4].

Exploitation

An attacker must be able to send a crafted IPv6 packet with a specific SRH to the target system. The triggering packet requires a two-segment type-3 SRH with CmprI=0 and CmprE=15, and is sent over the loopback interface (lo) using an AF_INET6/SOCK_RAW socket with IPV6_HDRINCL set. After one pass, headroom is reduced to 8 bytes, causing the subsequent skb_push() to fail and leading to a memory corruption. No authentication or special privileges are needed beyond the ability to inject raw IPv6 packets.

Impact

A successful exploitation results in a 14-byte out-of-bounds write in kernel memory, as reported by KASAN, specifically in ipv6_rthdr_rcv. This memory corruption can cause a kernel crash (denial of service) and may potentially be leveraged by an attacker to achieve arbitrary code execution or privilege escalation, depending on system configuration and memory layout.

Mitigation

Patches have been committed to the Linux kernel stable trees as referenced in [1][2][3][4]. The fix modifies ipv6_rpl_srh_rcv() to expand the headroom whenever the remaining space is less than the push size plus mac_len, ensuring enough room for the rebuilt MAC header. Users should apply the corresponding patch or update to a kernel version containing the fix (e.g., versions including commits 7398ebefbfd4, 4babc2d9fda2, 8e8be63465a5, or c261d07a8057). No workaround is documented; the only mitigation is to install the patched kernel.