ACK: [SRU][Q][PATCH 0/1] CVE-2026-43037

[Manuel Diewald]

On Fri, Jun 19, 2026 at 06:58:15AM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43037
> 
> [ Impact ]
> 
> ip4ip6_err() in the IPv6 tunnel code calls icmp_send() on a cloned skb whose
> cb[] was previously written by the IPv6 receive path as struct inet6_skb_parm.
> icmp_send() then passes IPCB(skb2) to __ip_options_echo(), which reinterprets
> that cb[] region as struct inet_skb_parm (IPv4), where inet6_skb_parm.nhoff
> overlaps inet_skb_parm.opt.rr and yields a non-zero rr value. As a result,
> __ip_options_echo() reads an attacker-controlled optlen from packet data and
> copies that many bytes into a fixed 40-byte stack buffer, causing memory
> corruption. This is a remotely triggerable issue with a CVSS score of 9.8.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> trusty: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> The fix clears skb2->cb[] and adds minimal IPv4 header validation (version ==
> 4, ihl >= 5) in the ip6_tunnel error path. If incorrect, regressions would be
> confined to the IPv4-over-IPv6 tunnel (ip6_tunnel) error handling, potentially
> affecting ICMP error delivery for tunneled traffic.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Manuel Diewald <manuel.diewald at canonical.com>

-- 
 Manuel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260619/7ec0be61/attachment.sig>