CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill
In the Linux kernel, the following vulnerability has been resolved:
net/ipv6: ioam6: prevent schema length wraparound in trace fill
ioam6filltracedata() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. ioam6filltracedata() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer.
Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43341?
The severity of CVE-2026-43341 is categorized as high due to potential impact on the integrity of trace data.
How do I fix CVE-2026-43341?
To fix CVE-2026-43341, upgrade to the latest version of the Linux kernel where the vulnerability has been addressed.
What systems are affected by CVE-2026-43341?
CVE-2026-43341 affects systems running specific versions of the Linux kernel that utilize ioam6 functionality.
What type of vulnerability is CVE-2026-43341?
CVE-2026-43341 is a vulnerability related to the ioam6 functionality in the net/ipv6 module of the Linux kernel.
Can CVE-2026-43341 be exploited remotely?
Yes, CVE-2026-43341 can potentially be exploited remotely if the affected systems are exposed to untrusted network traffic.