THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-43037 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm.

[NVD] CVE-2026-43037 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm.

lownvdPublished 2026-05-01

CVE-2026-43037 CVSS: 9.8 CRITICAL Published: 2026-05-01T15:16:48.383

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Oskar Kjos reported the following problem.

ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-43037