Look up another CVE · open CVE-2026-43083 in the interactive tracker
CVE-2026-43083
net: ioam6: fix OOB and missing lock
Published 2026-05-06 (5 months ago) by the Linux kernel CNA. Subsystem net/ipv6. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-43083 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 6.19.14-1 | Update the kernel and reboot. Fixed in 6.19.14-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.19.14-1 | Update the kernel and reboot. Fixed in 6.19.14-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv6/ioam6.c
- What this is
- NETWORKING [IOAM]MAINTAINERS section matched on net/ipv6/ioam6* · Maintained
Check it on the machine
grep -w CONFIG_IPV6 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_IPV6
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-05-06 (5 months ago)source
- CVSS
- 9.1 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.63%, higher than 49.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ipv6
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.17 | 6.18.24 | 6d1d9ed9b409 |
| 5.17 | 6.19.14 | 95a1334748c9 |
| 5.17 | 7.0 | b30b1675aa2b |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable input path is reached by received IPv6 packets carrying a Hop-by-Hop IOAM Pre-allocated Trace option with queue-depth bit 6 set. In a reasonable IOAM-enabled routing deployment, an unauthenticated network peer can send such packets to the ingress interface.
- AC:LAttack complexity, low
- The attacker controls the packet contents, including the IOAM trace type, and can repeatedly send packets; the RX-queue-to-TX-queue mismatch is a plausible target configuration rather than a race or condition the attacker must win. The OOB access occurs deterministically once the packet is processed with an out-of-range queue mapping.
- PR:NPrivileges required, none
- Although enabling IOAM and creating namespaces are administrative configuration steps, the actual vulnerable code path processes unauthenticated network packets after IOAM is enabled. The packet sender needs no local account or kernel privileges.
- UI:NUser interaction, none
- No victim user action is required. Packet reception and IPv6 hop-by-hop IOAM processing trigger the vulnerable function automatically.
- S:UScope, unchanged
- The impact remains within the kernel/networking security authority of the affected system. This is not a VM escape, sandbox escape, or cross-authority boundary violation.
- C:HConfidentiality impact, high
- The bug is an out-of-bounds read of the egress device's `dev->_tx[]` array followed by dereferencing data as a `Qdisc`, and the resulting value can be copied into IOAM trace data. Under the required overestimation rule, this is treated as high confidentiality impact because it is not a strictly bounded, harmless read.
- I:NIntegrity impact, none
- The vulnerable operation reads an out-of-bounds queue entry and qdisc statistics; it does not provide an out-of-bounds write or an apparent primitive to modify kernel memory. Any packet trace update is part of normal processing of the attacker's packet.
- A:HAvailability impact, high
- An out-of-bounds queue pointer dereference can fault or otherwise oops/panic the kernel, especially when the computed `Qdisc` pointer is invalid. The same crafted packet pattern can be sent repeatedly, making denial of service high impact.