CVE-2026-43037: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43037 is an out-of-bounds write vulnerability in the Linux kernel's ip6_tunnel module, specifically in the ip4ip6_err() function. It was reported by Oskar Kjos and disclosed on May 1, 2026. The flaw affects Linux kernel versions from 2.6.22 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0-rc1 and later. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat).

The root cause is a type confusion between two kernel control buffer structures (CWE-787: Out-of-bounds Write). When ip4ip6_err() processes an ICMP error for an IPv6-tunneled IPv4 packet, it calls icmp_send() on a cloned socket buffer (skb2) whose cb[] field was populated by the IPv6 receive path as struct inet6_skb_parm. However, icmp_send() passes IPCB(skb2) to __ip_options_echo(), which reinterprets the same cb[] region as struct inet_skb_parm (IPv4). Because the two structures have different layouts, inet6_skb_parm.nhoff at offset 14 overlaps with inet_skb_parm.opt.rr, producing a non-zero rr value. This causes __ip_options_echo() to read an attacker-controlled optlen from packet data at sptr[rr+1] and copy up to that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). The fix clears skb2->cb[] before use and adds minimal IPv4 header validation (version == 4, ihl >= 5) (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to trigger a stack buffer overflow in the kernel, leading to memory corruption, denial of service, potential privilege escalation, or remote code execution at kernel level. Because no authentication or user interaction is required and the attack vector is network-accessible, the confidentiality, integrity, and availability impacts are all rated High. Systems acting as IPv6 tunnel endpoints (ip4ip6 tunnels) are directly at risk, and kernel-level compromise could enable full system takeover and lateral movement within a network (GitHub Advisory, Red Hat).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify systems running vulnerable Linux kernel versions (2.6.22 through pre-patch versions) that are configured as IPv6 tunnel endpoints (ip4ip6 tunnels), using network scanning tools such as Nmap or Shodan.
2. Craft malicious packet: Construct a specially crafted IPv6-tunneled IPv4 packet designed to trigger an ICMP error response. The IPv4 payload must contain attacker-controlled data at the position that will be read as optlen (i.e., at sptr[rr+1] where rr is derived from the overlapping inet6_skb_parm.nhoff field at offset 14).
3. Send packet to target: Transmit the crafted packet to the target system's IPv6 tunnel interface. The kernel's IPv6 receive path writes struct inet6_skb_parm into the cloned skb's cb[] field.
4. Trigger type confusion: The ip4ip6_err() function processes the ICMP error and calls icmp_send(), which reinterprets cb[] as struct inet_skb_parm, causing __ip_options_echo() to use the attacker-influenced rr value.
5. Overflow stack buffer: __ip_options_echo() reads the attacker-controlled optlen and copies up to that many bytes into the 40-byte dopt->__data stack buffer, causing an out-of-bounds write and potential kernel stack corruption.
6. Achieve objective: Depending on exploit reliability and kernel mitigations (KASLR, stack canaries), the attacker may achieve denial of service (kernel panic) or, with a more refined exploit, kernel-level code execution (GitHub Advisory).

• Network: Unusual or malformed IPv6-tunneled IPv4 packets (protocol 41 / SIT tunnels) arriving at tunnel endpoints, particularly those triggering ICMP error responses; unexpected ICMP traffic originating from tunnel interfaces.
• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg referencing ip4ip6_err, __ip_options_echo, or stack corruption; unexpected kernel BUG/WARNING traces in system logs.
• Process/System: Unexpected system reboots or kernel crashes on systems acting as IPv6 tunnel endpoints; anomalous kernel stack traces involving ip6_tunnel or icmp_send functions.
• File System: Core dump files generated by kernel crashes in /var/crash or similar directories, potentially indicating exploitation attempts.

Apply the available kernel patches for your distribution immediately. Fixed versions are: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0-rc1 and later. Distribution-specific updates are available from Red Hat (RHSA-2026:22900, RHSA-2026:22940, RHSA-2026:22964, RHSA-2026:23224, RHSA-2026:25121, RHSA-2026:25191, RHSA-2026:25217), SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1, SUSE-SU-2026:2310-1, SUSE-SU-2026:2317-1, SUSE-SU-2026:2331-1), and Amazon Linux (Red Hat, SUSE Advisory). If immediate patching is not possible, restrict network access to systems running vulnerable kernels, particularly filtering IPv6 tunnel traffic, and disable IPv6 tunneling (ip6_tunnel / SIT modules) if not operationally required (GitHub Advisory).

Red Hat has acknowledged the vulnerability and issued multiple errata updates addressing it across their product lines (Red Hat). SUSE has similarly released several security updates. The vulnerability was originally reported by Oskar Kjos, who also suggested the fix of clearing skb2->cb[]. No significant broader media coverage or notable social media discussion has been identified beyond standard vendor advisory channels.