Answer in brief
CVE-2026-43501 records a Critical severity (CVSS 9.8) vulnerability in ipv6: rpl: reserve mac_len headroom when recompressed SRH grows. The current sources do not mark it as known exploited. The current feed maps Red Hat/kernel-rt (generic), Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/kernel-rt (generic), Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/kernel-rtgeneric | * | Not reported |
| Linux/Linuxgeneric | >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <bde199c72d319a4e207f88daabc888317504e2fb || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <8e8be63465a5e80394c70324603dfea1bfdad48f || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <4babc2d9fda2df43823b85d08a0180b68f1b0854 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <c261d07a80576dc8ccf394ef8f074f8c67a06b37 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <7398ebefbfd4f8a31d4f665a4213302fa995494b || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <9e6bf146b55999a095bb14f73a843942456d1adc | bde199c72d319a4e207f88daabc888317504e2fb, be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e, 0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402, 8e8be63465a5e80394c70324603dfea1bfdad48f, 4babc2d9fda2df43823b85d08a0180b68f1b0854, c261d07a80576dc8ccf394ef8f074f8c67a06b37, 7398ebefbfd4f8a31d4f665a4213302fa995494b, 9e6bf146b55999a095bb14f73a843942456d1adc |
| Linux/Linuxgeneric | 5.7 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.7 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.7 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.7 <* | * |
Published upstream
May 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompressed header can be larger than the received one when the swap reduces the common-prefix length the segments share with daddr (CmprI=0, CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes). pskb_expand_head() was gated on segments_left == 0, so on earlier segments the push consumed unchecked headroom. Once skb_push() leaves fewer than skb->mac_len bytes in front of data, skb_mac_header_rebuild()'s call to: skb_set_mac_header(skb, -skb->mac_len); will store (data - head) - mac_len into the u16 mac_header field, which wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB past skb->head. A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv. Fix this by expanding the head whenever the remaining room is less than the push size plus mac_len, and request that much extra so the rebuilt MAC header fits afterwards.
Quoted source text, attributed separately from HOL analysis.