LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43099: ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmp_build_probe() ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing this error pointer to dev_hold() will cause a kernel crash with null-ptr-deref. Instead, silently discard the request. RFC 8335 does not appear to define a specific response for the case where an IPv6 interface identifier is syntactically valid but the implementation cannot perform the lookup at runtime, and silently dropping the request may safer than misreporting "No Such Interface".

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A remote network request can crash certain Linux systems when IPv6 is built as a module but is not loaded. The issue affects availability only; the supplied record reports no data theft or modification impact. A successful trigger could interrupt services until the system recovers or restarts.

Executive priority

Prioritize remediation for externally reachable infrastructure matching the required IPv6 configuration, especially systems where a crash would disrupt critical services. Use normal urgent patch governance rather than emergency incident response unless related crashes or targeting are observed.

Technical view

icmp_build_probe() can pass an ERR_PTR(-EAFNOSUPPORT) from ipv6_dev_find() to dev_hold() when CONFIG_IPV6=m and the IPv6 stack is inactive, causing a null-pointer dereference and kernel crash. The CVSS 3.1 score is 7.5: network-accessible, low complexity, unauthenticated, and availability-impacting.

Likely exposure

Exposure is configuration-dependent. Prioritize Linux hosts accepting relevant ICMP traffic where IPv6 is compiled as a module but not loaded. The supplied affected data names releases from 5.13 through 7.0, but lacks clear range operators and distribution package mappings.

Exploitation context

The CVSS vector indicates a potentially remote, unauthenticated denial of service. The record is not in KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. Treat exploitation status as unconfirmed.

Researcher notes

The vulnerable path and failure condition are well described, and seven stable-tree fixes are referenced. Precise affected and fixed release boundaries remain ambiguous because the supplied version list has no comparison operators or commit-to-release mapping. No CWE, proof of concept, or exploitation evidence is supplied.

Mitigation direction

  • Apply Linux or distribution kernel updates containing the cited stable fixes.
  • Consult distribution guidance for exact fixed package versions and backport status.
  • Prioritize exposed systems matching the modular, inactive IPv6 configuration.
  • Confirm the updated kernel is running after the approved maintenance process.

Validation and detection

  • Inventory running kernel versions and distribution package revisions.
  • Identify systems built with IPv6 as a module.
  • Determine whether the IPv6 module is inactive on those systems.
  • Verify vendor packages include an applicable cited fix or documented backport.
  • Review kernel crash telemetry for related ICMP probe failures.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43099 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-43099Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd329ea5bd8845f0b196bf41b18b6173340d6e0e4, d329ea5bd8845f0b196bf41b18b6173340d6e0e4, d329ea5bd8845f0b196bf41b18b6173340d6e0e4, d329ea5bd8845f0b196bf41b18b6173340d6e0e4, d329ea5bd8845f0b196bf41b18b6173340d6e0e4, d329ea5bd8845f0b196bf41b18b6173340d6e0e4, d329ea5bd8845f0b196bf41b18b6173340d6e0e4unaffected
LinuxLinux5.13, 0, 5.15.209, 6.1.175, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.