CVE-2026-43083: net: ioam6: fix OOB and missing lock
In the Linux kernel, the following vulnerability has been resolved:
net: ioam6: fix OOB and missing lock
When trace->type.bit6 is set:
if (trace->type.bit6) { ... queue = skbgettxqueue(dev, skb); qdisc = rcudereference(queue->qdisc);
This code can lead to an out-of-bounds access of the dev->tx[] array when isinput is true. In such a case, the packet is on the RX path and skb->queuemapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skbgetqueuemapping(skb) will exceed dev->numtxqueues. Add a check to avoid this situation since skbgettxqueue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature.
While at it, add missing lock around qdiscqstatsqlenbacklog(). The function ioam6filltracedata() is called from both softirq and process contexts, hence the use of spinlockbh() here.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add the missing lock around qdisc_qstats_qlen_backlog() because __ioam6_fill_trace_data() can run in both softirq and process contexts; use spin_lock_bh() in the net: ioam6 fix OOB and missing lock path.
Linux kernel (ioam6 trace fill path, __ioam6_fill_trace_data) locking for qdisc_qstats_qlen_backlog() = Use spin_lock_bh() around qdisc_qstats_qlen_backlog() - Compensating control
Clamp the tx queue index derived from skb_get_queue_mapping(skb) so it cannot exceed dev->num_tx_queues (avoid out-of-bounds access to dev->_tx[] when ingress RX queue mapping is larger than the egress device’s num_tx_queues).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43083?
CVE-2026-43083 has a critical severity rating of 9.1.
How do I fix CVE-2026-43083?
To fix CVE-2026-43083, update the Linux kernel to the latest patched version where this vulnerability has been addressed.
What impact does CVE-2026-43083 have on Linux systems?
CVE-2026-43083 can lead to out-of-bounds access, potentially causing system crashes or data corruption.
Is CVE-2026-43083 easily exploitable?
CVE-2026-43083 is considered critical with potential for exploitation due to the nature of the out-of-bounds access vulnerability.
What are the affected systems by CVE-2026-43083?
CVE-2026-43083 affects systems running vulnerable versions of the Linux kernel.