{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: icmp: clear skb2-\\u003ecb[] in ip6_err_gen_icmpv6_unreach()\\n\\nSashiko AI-review observed:\\n\\n In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet\\n where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2\\n and passed to icmp6_send(), it uses IP6CB(skb2).\\n\\n IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso\\n offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm\\n at offset 18.\\n\\n If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao\\n would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called\\n and uses ipv6_find_tlv(skb, opt-\\u003edsthao, IPV6_TLV_HAO).\\n\\n This would scan the inner, attacker-controlled IPv6 packet starting at that\\n offset, potentially returning a fake TLV without checking if the remaining\\n packet length can hold the full 18-byte struct ipv6_destopt_hao.\\n\\n Could mip6_addr_swap() then perform a 16-byte swap that extends past the end\\n of the packet data into skb_shared_info?\\n\\n Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and\\n ip6ip6_err() to prevent this?\\n\\nThis patch implements the first suggestion.\\n\\nI am not sure if ip6ip6_err() needs to be changed.\\nA separate patch would be better anyway.”,”published”:”2026-05-01T14:15:35.986Z”,”modified”:”2026-05-03T05:46:17.465Z”,”type”:”cve”,”title”:”ipv6: icmp: clear skb2-\\u003ecb[] in ip6_err_gen_icmpv6_unreach()”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/c438ba010171b70bad22fc18b1d5bdc3627476e8\\nhttps:\/\/git.kernel.org\/stable\/c\/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7\\nhttps:\/\/git.kernel.org\/stable\/c\/a4437faf135da293d16fcc4cc607316742bd0ebb\\nhttps:\/\/git.kernel.org\/stable\/c\/3d5127d998de617b130aae96b138dba22ac6a8a7\\nhttps:\/\/git.kernel.org\/stable\/c\/e41953e7d118e2702bcb217879c173d9d1d3cd4e\\nhttps:\/\/git.kernel.org\/stable\/c\/a2edbb6393972a02114b6003953a5cef3104fada\\nhttps:\/\/git.kernel.org\/stable\/c\/1ceeebd5bd6d855b17a5df625109bfe29129d7cf\\nhttps:\/\/git.kernel.org\/stable\/c\/86ab3e55673a7a49a841838776f1ab18d23a67b5″,”id”:”CVE-2026-43038″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux ca15a078bd907df5fc1c009477869c5cbde3b753\\nLinux Linux 3.13″,”sourceHref”:””,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”ca15a078bd907df5fc1c009477869c5cbde3b753″,”vendor”:”Linux”,”ai_description”:”AI processing failed – invalid JSON response”,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: icmp: clear skb2-\\u003ecb[] in ip6_err_gen_icmpv6_unreach()\\n\\nSashiko AI-review observed:\\n\\n In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,35,12,13,7,11,5],"class_list":["post-51011","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n