{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-08T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill",
    "id" : "2468097",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2468097"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-787",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nnet/ipv6: ioam6: prevent schema length wraparound in trace fill\nioam6_fill_trace_data() stores the schema contribution to the trace\nlength in a u8. With bit 22 enabled and the largest schema payload,\nsclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the\nremaining-space check. __ioam6_fill_trace_data() then positions the\nwrite cursor without reserving the schema area but still copies the\n4-byte schema header and the full schema payload, overrunning the trace\nbuffer.\nKeep sclen in an unsigned int so the remaining-space check and the write\ncursor calculation both see the full schema length.", "A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM6) trace fill functionality. An integer overflow vulnerability exists in the `ioam6_fill_trace_data()` function, where the schema length calculation can wrap around due to being stored in an 8-bit unsigned integer. This bypasses buffer size checks, leading to a buffer overflow that can result in a denial of service or other memory corruption issues." ],
  "statement" : "An IPv6 IOAM trace buffer overflow can occur because the schema length contribution is stored in an 8 bit value. With bit 22 enabled and the largest schema payload, sclen wraps from 256 to 0, bypassing the remaining space check while the code still copies the schema header and payload past the trace buffer. The issue is network reachable, although practical exposure is usually limited to IOAM enabled domains or trusted IPv6 networks rather than the public Internet. Impact is kernel memory corruption through an out of bounds write and may cause denial of service or in worst case confidentiality and integrity impact. For the Red Hat Enterprise Linux before 10 is not actual, because not introduced yet (the Fixes patch 8c6f6fa6772696be0c047a711858084b38763728 not applied yet).",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36541",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.31.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33215",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "kernel-0:6.12.0-55.84.1.el10_0"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-43341\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43341\nhttps://lore.kernel.org/linux-cve-announce/2026050824-CVE-2026-43341-7c3e@gregkh/T" ],
  "name" : "CVE-2026-43341",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}