DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-43501: CVE-2026-43501: Heap Out-of-Bounds Write in Linux Kernel IPv6 RPL Segment Routing Header Processing

#security #cve #cybersecurity

CVE-2026-43501: Heap Out-of-Bounds Write in Linux Kernel IPv6 RPL Segment Routing Header Processing

Vulnerability ID: CVE-2026-43501
CVSS Score: 9.8
Published: 2026-05-21

A critical heap out-of-bounds (OOB) write vulnerability exists in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) Segment Routing Header (SRH) processing logic. The vulnerability is located within net/ipv6/exthdrs.c, specifically in the ipv6_rpl_srh_rcv function. Under specific circumstances, when a packet containing a compressed RPL Source Routing Header is processed, segment swapping can reduce the common-prefix length, causing the recompressed header to grow. Because the kernel fails to validate available headroom on intermediate segments, a buffer underflow occurs during skb_push. This leads to an integer wrap in the MAC header offset pointer during MAC header rebuilding, causing a 14-byte out-of-bounds memory write roughly 64 KiB past the socket buffer.

TL;DR

Unauthenticated remote heap out-of-bounds write in Linux kernel IPv6 RPL SRH processing due to insufficient headroom validation, leading to potential remote code execution or system crash.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-787 (Primary), CWE-131 (Secondary)
  • Attack Vector: Network (AV:N)
  • CVSS Score: 9.8 (Critical)
  • EPSS Score: 0.00595
  • EPSS Percentile: 45.08%
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • Linux Kernel 5.7.x - 5.10.x
  • Linux Kernel 5.11.x - 5.15.x
  • Linux Kernel 5.16.x - 6.1.x
  • Linux Kernel 6.2.x - 6.6.x
  • Linux Kernel 6.7.x - 6.12.x
  • Linux Kernel 6.13.x - 6.18.x
  • Linux Kernel 6.19.x - 7.0.x

Exploit Details

  • Wiz.io: Technical description of the vulnerability including reproduction details.

Mitigation Strategies

  • Apply kernel security updates to fixed versions
  • Deploy ip6tables/nftables rules to drop Routing Header Type 3 packets

Remediation Steps:

  1. Identify affected Linux kernel versions running in the infrastructure
  2. Schedule maintenance windows to apply kernel updates
  3. Reboot systems into the patched kernel version
  4. Verify mitigation using network packet filters if patching is delayed

References

Read the full report for CVE-2026-43501 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)