CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
In the Linux kernel, the following vulnerability has been resolved:
net: correctly handle tunneled traffic on IPV6CSUM GSO fallback
NETIFFIPV6CSUM only advertises support for checksum offload of packets without IPv6 extension headers. Packets with extension headers must fall back onto software checksumming. Since TSO depends on checksum offload, those must revert to GSO.
The below commit introduces that fallback. It always checks network header length. For tunneled packets, the inner header length must be checked instead. Extend the check accordingly.
A special case is tunneled packets without inner IP protocol. Such as RFC 6951 SCTP in UDP. Those are not standard IPv6 followed by transport header either, so also must revert to the software GSO path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43057?
CVE-2026-43057 has been assigned a severity rating that indicates a moderate risk to Linux kernel environments.
How do I fix CVE-2026-43057?
To fix CVE-2026-43057, ensure that you update your Linux kernel to the latest stable version where the vulnerability has been patched.
What systems are affected by CVE-2026-43057?
CVE-2026-43057 affects Linux kernel installations that handle tunneled traffic with IPV6_CSUM GSO fallback.
What does CVE-2026-43057 involve?
CVE-2026-43057 involves a vulnerability in the Linux kernel's handling of tunneled traffic related to checksum offloading.
Is CVE-2026-43057 being actively exploited?
As of now, there is no public indication that CVE-2026-43057 is being actively exploited in the wild.