CVE-2026-43186

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

On the receive path, __ioam6_fill_trace_data() uses trace->nodelen

to decide how much data to write for each node. It trusts this field

as-is from the incoming packet, with no consistency check against

trace->type (the 24-bit field that tells which data items are

present). A crafted packet can set nodelen=0 while setting type bits

0-21, causing the function to write ~100 bytes past the allocated

region (into skb_shared_info), which corrupts adjacent heap memory

and leads to a kernel panic.

Add a shared helper ioam6_trace_compute_nodelen() in ioam6.c to

derive the expected nodelen from the type field, and use it:

- in ioam6_iptunnel.c (send path, existing validation) to replace

the open-coded computation;

- in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose

nodelen is inconsistent with the type field, before any data is

w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References