Loading story…
Red Hat disclosed CVE-2026-43037, a critical Linux kernel flaw in the ip6_tunnel component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of type confusion tracked by MITRE as CWE-843. In the vulnerable path, __ip_options_echo() can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges.
Red Hat rated the issue CVSS 8.8 and published fixes across multiple RHEL and related product streams, including RHSA-2026:27719 for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears skb2->cb[] before calling icmp_send() and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including kernel-2.6.32-754.61.1.el6 for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the ip6_tunnel module from loading as a temporary mitigation until patches are installed.
See real exploitation activity before you spend the cycle.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:27719, a critical kernel security advisory for Red Hat Enterprise Linux 6 Extended Lifecycle Support Extension. The advisory made updated kernel packages available and included a fix for CVE-2026-43037.
The Linux kernel CVE team announced CVE-2026-43037 for a flaw in ip4ip6_err() in net/ipv6/ip6_tunnel.c caused by reused skb cb[] data being interpreted as the wrong structure type. The announcement said the issue was introduced in Linux 2.6.22, credited Oskar Kjos for reporting it, and documented fixes across multiple stable branches including 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0.
Red Hat published its security entry for CVE-2026-43037, describing a critical Linux kernel flaw in IPv4-over-IPv6 tunnel error handling tied to CWE-843. The entry says malicious ICMPv6 error messages can trigger a stack-based buffer overflow that may cause denial of service, information disclosure, or possible kernel-level code execution.
Red Hat listed CVE-2026-43037 as fixed for Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel-rt in advisory RHSA-2026:41236.
Red Hat listed an additional fix for CVE-2026-43037 for NVIDIA for RHEL 10 in advisory RHSA-2026:33486.
Red Hat listed CVE-2026-43037 as fixed for the Red Hat Enterprise Linux 10 kpatch stream in advisory RHSA-2026:28742.
Red Hat listed CVE-2026-43037 as fixed for Red Hat Enterprise Linux 7 Extended Lifecycle Support in advisory RHSA-2026:27729.
Red Hat listed CVE-2026-43037 as fixed for NVIDIA for RHEL 10 in advisory RHSA-2026:25534.
Red Hat listed CVE-2026-43037 as fixed for Red Hat Enterprise Linux 10 in advisory RHSA-2026:25191.
Red Hat listed fixes for CVE-2026-43037 in RHSA-2026:25120 for RHEL 8 kernel-rt and RHSA-2026:25121 for the RHEL 8 kernel.
Red Hat listed CVE-2026-43037 as fixed for Red Hat Enterprise Linux 10.0 Extended Update Support in advisory RHSA-2026:24343.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's netfilter `ip6t_eui64` component, tracked as **CVE-2026-31685**, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in `eui64_mt6()`, where the code could still call `eth_hdr(skb)` when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing. The issue affected code dating back to Linux kernel **2.6.12** and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including **6.12.83**, **6.18.24**, **6.19.14**, and **7.0**, while Red Hat shipped patches through security errata for multiple **RHEL 7, 8, 9, and 10** product variants. Red Hat rated the flaw **Moderate** with a **CVSS 7.1** for its products, although **cve.org** listed a **9.4** score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
Aug 25, 2026
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
A flaw in the Linux kernel's netfilter `xt_tcpmss` module, tracked as **`CVE-2026-43190`**, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the `tcpmss` match. The Linux kernel CVE team published fixes across multiple stable branches, including **5.10.252**, **5.15.202**, **6.1.165**, **6.6.128**, **6.12.75**, **6.18.16**, **6.19.6**, and **7.0**, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in **RHSA-2026:44694** for **Red Hat Enterprise Linux 10.0 Extended Update Support** kernel packages, alongside fixes for **`CVE-2026-31684`** and **`CVE-2026-46152`**; updated packages include kernel version **`6.12.0-55.92.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat said affected systems should be rebooted after installation.
Aug 25, 2026