LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43038: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in Linux IPv6 error handling can misread leftover IPv4 packet metadata as IPv6 metadata. A forged network packet may then cause an unsafe memory operation in the kernel. The supplied record rates it CVSS 9.8, but the described impact remains partly theoretical and no active exploitation is established.

Executive priority

Treat as an urgent kernel patching issue for exposed Linux systems because the vulnerable path is remotely reachable and may corrupt kernel memory. Prioritize internet-facing and network-control systems, while avoiding claims of confirmed compromise: active exploitation is not supported by the supplied evidence.

Technical view

A cloned packet retains an IPv4 inet_skb_parm control block that icmp6_send() interprets as inet6_skb_parm. A CIPSO offset can overlap dsthao, directing IPv6 option parsing into attacker-controlled data and potentially causing a 16-byte swap beyond packet data. The fix clears skb2->cb before IPv6 ICMP processing.

Likely exposure

Exposure is limited to affected Linux kernels where untrusted forged ICMPv4 errors containing CIPSO metadata and an inner IPv6 packet can reach the vulnerable path. The supplied version list is ambiguous, so determine exposure using the running distribution kernel build and its vendor advisory or backport status.

Exploitation context

The CVSS vector describes remote, unauthenticated, low-complexity exploitation without user interaction. However, the source describes the memory overwrite as a possibility, KEV is false, and no supplied source confirms exploitation in the wild or a working public exploit.

Researcher notes

The central issue is cross-protocol reuse of skb->cb and CWE-843 type confusion. The patch addresses ip6_err_gen_icmpv6_unreach() by clearing the cloned control block. The source explicitly leaves open whether ip6ip6_err() also requires change, so the completeness of related-path remediation is not established here.

Mitigation direction

  • Install a vendor kernel update containing the skb control-block clearing fix.
  • Review Linux distribution advisories for the exact kernel build and backport status.
  • Where operationally safe, filter untrusted forged ICMPv4 errors and unexpected CIPSO traffic.
  • Prioritize exposed network infrastructure and hosts processing both IPv4 errors and IPv6 traffic.

Validation and detection

  • Inventory running kernel builds across Linux hosts, appliances, containers, and hypervisors.
  • Compare each build against distribution advisories and the listed stable-kernel fixes.
  • Confirm the vendor package includes an equivalent backport, not merely a similar version number.
  • After updating, reboot where required and verify the newly running kernel build.
  • Review kernel crash and memory-corruption telemetry for unexplained networking-related events.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-843: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-43038 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
26Source links

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux
7.3CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-43038Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. ADP timelineredhat-SADP

    Reported to Red Hat.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

redhat-SADPkernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
other:Red Hat severity ratingcvssV3_1
  • 2026-05-01T00:00:00.000Z: Reported to Red Hat.
  • 2026-05-01T00:00:00.000Z: Made public.
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxca15a078bd907df5fc1c009477869c5cbde3b753, ca15a078bd907df5fc1c009477869c5cbde3b753, ca15a078bd907df5fc1c009477869c5cbde3b753, ca15a078bd907df5fc1c009477869c5cbde3b753, ca15a078bd907df5fc1c009477869c5cbde3b753, ca15a078bd907df5fc1c009477869c5cbde3b753, ca15a078bd907df5fc1c009477869c5cbde3b753, ca15a078bd907df5fc1c009477869c5cbde3b753unaffected
LinuxLinux3.13, 0, 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0affected
Weakness

CWE details

CWE-843

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-843 · source CWE mapping

Access of Resource Using Incompatible Type ('Type Confusion')

Access of Resource Using Incompatible Type ('Type Confusion') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs