LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43083: net: ioam6: fix OOB and missing lock

In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.

CriticalCVSS 9.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux networking flaw in IOAM6 trace handling can read outside a transmit-queue array when packets cross interfaces with mismatched queue counts. The supplied severity is critical because successful triggering could expose kernel memory or crash the system. Only systems using the affected IOAM6 path appear relevant.

Executive priority

Treat as an urgent, targeted kernel update rather than evidence of universal Linux compromise. Rapidly identify systems using IOAM6, confirm vendor exposure, and patch affected network-facing hosts. No active exploitation is established by the supplied evidence.

Technical view

When IOAM6 trace type bit 6 is processed on the receive path, the ingress RX queue index may be reused against an egress device with fewer TX queues. This can cause an out-of-bounds dev->_tx[] access. The resolution adds bounds checking and a missing spin_lock_bh() around qdisc queue statistics access.

Likely exposure

Potential exposure is limited to affected Linux kernels processing IOAM6 traces with bit 6 set, particularly where an ingress interface has more RX queues than the egress interface has TX queues. The supplied version data is ambiguous, so exact affected and fixed release boundaries require vendor confirmation.

Exploitation context

The supplied CVSS rates this network-accessible, low-complexity, unauthenticated, and user-interaction-free. However, no KEV listing or cited evidence of active exploitation is provided. Practical exploitability and reliable confidentiality impact are not established by the bundle.

Researcher notes

The fault depends on RX-path queue_mapping exceeding the egress device's num_tx_queues when trace bit 6 requests queue visibility. The same review identified missing synchronization around qdisc_qstats_qlen_backlog(). The bundle does not establish a public proof of concept, exploitation reliability, or precise distribution-specific package status.

Mitigation direction

  • Apply a vendor-supported kernel containing the referenced IOAM6 fixes.
  • Prioritize internet-facing or untrusted-network systems that actively use IOAM6.
  • If immediate patching is impossible, consult vendor guidance about safely disabling unused IOAM6 functionality.
  • Avoid relying solely on the ambiguous version ranges in the supplied record.

Validation and detection

  • Inventory Linux systems and identify whether IOAM6 is enabled or used.
  • Compare installed kernel builds with vendor advisories and referenced stable commits.
  • Review interface RX and TX queue counts on systems processing IOAM6 traffic.
  • Confirm the bounds check and qdisc locking fix are present after updating.
  • Review kernel diagnostics for unexplained networking faults or out-of-bounds reports.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43083 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2026-43083Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb63c5478e9cb1d1504eb02d9dac827ad24612b32, b63c5478e9cb1d1504eb02d9dac827ad24612b32, b63c5478e9cb1d1504eb02d9dac827ad24612b32unaffected
LinuxLinux5.17, 0, 6.18.24, 6.19.14, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.