Loading vulnerability…
CVE-2026-43501 is an out-of-bounds write in Linux kernel IPv6 RPL processing. The ipv6_rpl_srh_rcv() path decompresses and recompresses an RFC 6554 type-3 Source Routing Header (SRH). Recomposed headers may be larger than received headers when segment swapping reduces the shared prefix with the destination address. Headroom expansion was conditional on segments_left being zero, allowing skb_push() on earlier segments to consume insufficiently checked skb headroom. If fewer than mac_len bytes remain before skb data, MAC-header rebuilding underflows the u16 mac_header offset and a subsequent memory move writes beyond the skb head allocation. The reported maximum SRH growth is 8 bytes; a crafted packet has been reported to produce a 14-byte out-of-bounds write.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a Linux kernel local exploit project for CVE-2026-43501, not a framework module. It contains a full exploit chain plus build/run tooling for a custom Ubuntu resolute kernel VM. Core exploit code is in C under poc/, with helper Bash scripts for building the kernel and launching a QEMU/vng guest, and a Python helper for DWARF-based kernel-structure triage. Main purpose: exploit an out-of-bounds write in Linux IPv6 RPL Source Routing Header handling in net/ipv6/exthdrs.c. REPORT.md documents the bug: when a received RPL SRH is recompressed to a larger header, skb_push() can consume headroom without reserving enough space for skb_mac_header_rebuild(), causing a MAC-header memmove write far past skb->head. The included diffs instrument the vulnerable kernel to trace skb/slab allocations. Repository structure: - build.sh: clones/builds the Ubuntu resolute kernel tree from Launchpad, forces relevant config options (USER_NS, NET_NS, IPV6, PACKET, VETH as module), and stages veth.ko into a guest-visible module tree. - run.sh: compiles the PoC, boots the built kernel in a VM, mounts /lib/modules from the staged tree, and optionally exposes a gdbstub on tcp::1234. - compile.sh: builds poc/main.c and supporting files into poc/x. - REPORT.md and NOTE.md: detailed vulnerability analysis, trigger conditions, packet invariants, and environment notes. - resolute-exthdrs.diff / resolute-kernel.diff: kernel instrumentation patches for tracing vulnerable allocations and candidate victim objects. - find-leak.py: pahole-based helper to identify candidate kernel structs with useful length/count/offset fields for exploitation. - poc/: exploit implementation. Exploit capabilities from poc/: - namespace.c enters a new user namespace and network namespace, maps the caller to uid/gid 0 inside the namespace, brings loopback up, and enables RPL sysctls via /proc/sys/net/ipv6/conf/*/rpl_seg_enabled. - packet.c creates a veth pair rpltx0/rplrx0 using rtnetlink, assigns IPv6 addresses fd00:4350:1::1 and fd00:4350:1::2, adds a neighbor entry mapping fd00:4350:1::2 to MAC 00:00:00:00:00:bb, and sends crafted raw IPv6 packets using socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) with IPV6_HDRINCL and SO_BINDTODEVICE=rpltx0. - build_rpl_packet() constructs the malicious IPv6 + RPL type-3 SRH + UDP packet. The trigger uses segment0 2001:db8::1 and compressed final segment fd00:4350:1::2 so recompression grows the SRH and reaches the vulnerable path. - rx_ring.c uses AF_PACKET PACKET_RX_RING/TPACKET_V3 on lo as a page-allocation/spray primitive. - sf.c uses IPv6 multicast group joins and MCAST_MSFILTER to allocate ip6_sf_socklist objects, consistent with the repo notes about targeting length/count fields for leaks. - pipe.c creates/resizes/fills anonymous pipes, likely to place pipe_buffer objects for later corruption. - main.c orchestrates heap grooming, leak attempts, and dirty/write attempts. It forks children, enters namespaces, sets up interfaces, performs a kernel base leak, then runs a second-stage corruption path if the leak succeeds. - exploit.c is a more advanced/weaponized variant. It embeds a target database, defines a core_pattern payload string "|/proc/%P/fd/666", prepares machine-code patch templates, repeatedly triggers the vulnerability, and waits for core_pattern to become attacker-controlled. Overall assessment: this is a real, advanced local kernel exploit repository with both a minimal vulnerability trigger and a full privilege-escalation chain. It is not merely a detector or crash PoC. The code is designed to run in a controlled VM against a specifically built vulnerable kernel, but the exploitation logic is substantive and includes leak, heap shaping, corruption, and kernel patching stages.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel IPv6 RPL vulnerability involving headroom reservation when a recompressed SRH grows, fixed in this Red Hat kernel update.
A Linux kernel IPv6 RPL vulnerability involving insufficient headroom reservation when a recompressed SRH grows.
A Linux kernel IPv6 RPL vulnerability involving headroom handling when a recompressed SRH grows, fixed in this update.
Referenced as one of many vulnerabilities solved by SUSE security updates; no technical details provided in the content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.