CVE-2026-43501: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43501 is a buffer overflow vulnerability in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) Source Routing Header (SRH) processing that can allow an unauthenticated remote attacker to trigger an out-of-bounds memory write, potentially enabling arbitrary code execution with kernel privileges. The flaw resides in the ipv6_rpl_srh_rcv() function and affects Linux kernel versions from commit 8610c7c6e3bd onward, with patches available in stable releases 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc2. It was published on May 21, 2026, and is currently awaiting full NVD analysis. The CVSS v3.1 base score is 9.8 (Critical) (Red Hat Advisory, GitHub Advisory).

The root cause is an incorrect calculation of buffer size (CWE-131) in ipv6_rpl_srh_rcv(). When the function decompresses an RFC 6554 SRH, swaps the next segment into ipv6_hdr->daddr, and recompresses, the resulting header can be up to 8 bytes larger than the original (when CmprI=0, CmprE>0, and seg[0][0] != daddr[0]). The pskb_expand_head() call that would allocate additional headroom was gated on segments_left == 0, meaning earlier segments bypassed this check entirely. When skb_push() exhausts the available headroom, skb_mac_header_rebuild() calls skb_set_mac_header(skb, -skb->mac_len), causing the u16 mac_header field to integer-wrap to approximately 65530; the subsequent memmove() then writes mac_len bytes roughly 64 KiB past skb->head, constituting an out-of-bounds write. A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over loopback with a two-segment type-3 SRH (CmprI=0, CmprE=15) is sufficient to trigger the bug, as confirmed by KASAN reporting a 14-byte OOB write in ipv6_rthdr_rcv (Red Hat Advisory, GitHub Advisory).

Successful exploitation results in a kernel-level out-of-bounds memory write approximately 64 KiB past the allocated socket buffer, with potential for arbitrary code execution at kernel privilege level. This means full compromise of confidentiality, integrity, and availability of the affected system — an attacker could read or modify arbitrary kernel memory, crash the system (denial of service), or escalate to root. Because the vulnerability is reachable via raw IPv6 sockets without authentication, it poses a significant risk to any Linux system with IPv6 RPL SRH processing enabled and reachable over the network (Red Hat Advisory, GitHub Advisory).

1. Reconnaissance: Identify Linux systems with IPv6 enabled and RPL SRH processing active (kernel versions from commit 8610c7c6e3bd up to the patched releases). Systems reachable over IPv6 with raw socket capabilities are potential targets.
2. Craft malicious packet: Construct an AF_INET6/SOCK_RAW/IPV6_HDRINCL packet containing a type-3 Source Routing Header with two segments, CmprI=0 and CmprE=15, such that seg[0][0] != daddr[0] to maximize the header growth (+8 bytes) upon recompression.
3. Send packet: Transmit the crafted packet to the target system over IPv6 (loopback or network interface). A single packet is sufficient to reduce headroom to 8 bytes after one processing pass.
4. Trigger OOB write: The kernel's ipv6_rpl_srh_rcv() processes the SRH, recompresses to a larger header, and calls skb_push() without sufficient headroom. The mac_header u16 field wraps to ~65530, and memmove() writes ~14 bytes approximately 64 KiB past skb->head.
5. Achieve kernel code execution: Leverage the out-of-bounds write to corrupt kernel memory structures (e.g., function pointers, security credentials) to escalate privileges or execute arbitrary code with kernel-level access (Red Hat Advisory, GitHub Advisory).

• Kernel Logs: KASAN (Kernel Address Sanitizer) reports of out-of-bounds write in ipv6_rthdr_rcv or ipv6_rpl_srh_rcv; kernel panic or oops messages referencing skb_mac_header_rebuild or skb_set_mac_header.
• Network: Unusual IPv6 packets with type-3 Source Routing Headers (Next Header = 43, Routing Type = 3) with CmprI=0 and CmprE=15 targeting the host; raw IPv6 socket traffic (AF_INET6/SOCK_RAW) from unexpected sources.
• Process: Unexpected privilege escalation events or processes running as root without corresponding authentication events; anomalous kernel module loads following receipt of crafted IPv6 packets.
• System: Unexpected system crashes or reboots; memory corruption artifacts detectable via kernel integrity checks (e.g., kmemleak, KASAN output in /var/log/kern.log or dmesg) (Red Hat Advisory).

Apply the kernel patch immediately — fixed versions are available in Linux stable releases 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc2. Vendor-specific updates have been issued by Red Hat (RHSA-2026:25191, RHSA-2026:25217), SUSE (SUSE-SU-2026:2310-1, SUSE-SU-2026:2331-1), and Mageia (2026-0174). As a workaround where patching is not immediately possible, restrict IPv6 raw socket access (e.g., via capabilities or network namespaces) and consider disabling IPv6 RPL SRH processing at the network level if RFC 6554 support is not required in your environment (Red Hat Advisory, SUSE Advisory, GitHub Advisory).

Red Hat assigned a Critical severity rating and published a CVE advisory with a Bugzilla tracking entry shortly after disclosure on May 21, 2026 (Red Hat Advisory). SUSE and Mageia issued security updates within days of the patch being available. The vulnerability was noted on the VulDB social feed (Mastodon/infosec.exchange) and tracked by the Yocto Project security mailing list. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database aggregation.