CVE-2026-43186 (GCVE-0-2026-43186)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-08-05 12:26
VLAI
Title
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts this field as-is from the incoming packet, with no consistency check against trace->type (the 24-bit field that tells which data items are present). A crafted packet can set nodelen=0 while setting type bits 0-21, causing the function to write ~100 bytes past the allocated region (into skb_shared_info), which corrupts adjacent heap memory and leads to a kernel panic. Add a shared helper ioam6_trace_compute_nodelen() in ioam6.c to derive the expected nodelen from the type field, and use it: - in ioam6_iptunnel.c (send path, existing validation) to replace the open-coded computation; - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose nodelen is inconsistent with the type field, before any data is written. Per RFC 9197, bits 12-21 are each short (4-octet) fields, so they are included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to 0xff1ffc00).
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 , < f4d9d4b8fd839719d564651671e24c62c545c23b (git)
Affected: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 , < fb3c662fafebc5b9d74417ed1de8759f6bb72143 (git)
Affected: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 , < 632d233cf2e64a46865ae2c064ae3c9df7c8864f (git)
Affected: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 , < 0591d6509c2ff13f09ea2998434aba0c0472e978 (git)
Affected: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 , < e90346a2f1e8917d5760a44a1f61c44e3b36d96b (git)
Affected: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 , < ea3632aefc04205436868541638e26f4a74d5637 (git)
Affected: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 , < 6db8b56eed62baacaf37486e83378a72635c04cc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.202 , ≤ 5.15.* (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ioam6.h",
            "net/ipv6/exthdrs.c",
            "net/ipv6/ioam6.c",
            "net/ipv6/ioam6_iptunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f4d9d4b8fd839719d564651671e24c62c545c23b",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "fb3c662fafebc5b9d74417ed1de8759f6bb72143",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "632d233cf2e64a46865ae2c064ae3c9df7c8864f",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "0591d6509c2ff13f09ea2998434aba0c0472e978",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "e90346a2f1e8917d5760a44a1f61c44e3b36d96b",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "ea3632aefc04205436868541638e26f4a74d5637",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "6db8b56eed62baacaf37486e83378a72635c04cc",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ioam6.h",
            "net/ipv6/exthdrs.c",
            "net/ipv6/ioam6.c",
            "net/ipv6/ioam6_iptunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace-\u003enodelen\nto decide how much data to write for each node. It trusts this field\nas-is from the incoming packet, with no consistency check against\ntrace-\u003etype (the 24-bit field that tells which data items are\npresent). A crafted packet can set nodelen=0 while setting type bits\n0-21, causing the function to write ~100 bytes past the allocated\nregion (into skb_shared_info), which corrupts adjacent heap memory\nand leads to a kernel panic.\n\nAdd a shared helper ioam6_trace_compute_nodelen() in ioam6.c to\nderive the expected nodelen from the type field, and use it:\n\n  - in ioam6_iptunnel.c (send path, existing validation) to replace\n    the open-coded computation;\n  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose\n    nodelen is inconsistent with the type field, before any data is\n    written.\n\nPer RFC 9197, bits 12-21 are each short (4-octet) fields, so they\nare included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to\n0xff1ffc00)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is reached while processing received IPv6 Hop-by-Hop IOAM options in the network stack. A remote packet sender can craft the IOAM trace header for an IOAM-enabled target.\nAC:L - Exploitation requires a malformed but straightforward IOAM Pre-allocated Trace option with inconsistent nodelen and type fields. There is no race or attacker-uncontrolled timing condition once IOAM is enabled on the target interface.\nPR:N - The packet processing path has no authentication or per-sender privilege check before calling the vulnerable fill routine. Although enabling IOAM and creating namespaces is administrative setup, a remote attacker against such a deployment needs no privileges.\nUI:N - No victim user action is needed. The vulnerable path runs automatically when the kernel receives and parses the crafted IPv6 packet.\nS:U - The corruption occurs inside the same kernel security authority that processes the packet. This is not a VM escape or other cross-scope boundary bypass.\nC:H - The bug is a kernel heap out-of-bounds write into adjacent skb memory, including skb_shared_info in the described case. Such memory corruption can be leveraged for kernel memory disclosure as part of exploitation.\nI:H - This is an out-of-bounds kernel heap write controlled by attacker-supplied packet fields and layout choices. Kernel heap corruption is defensibly exploitable for arbitrary modification or code execution.\nA:H - The fix commit states the corruption leads to a kernel panic, and malformed packets can be sent repeatedly. Kernel panic or crash is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:24.342Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f4d9d4b8fd839719d564651671e24c62c545c23b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb3c662fafebc5b9d74417ed1de8759f6bb72143"
        },
        {
          "url": "https://git.kernel.org/stable/c/632d233cf2e64a46865ae2c064ae3c9df7c8864f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0591d6509c2ff13f09ea2998434aba0c0472e978"
        },
        {
          "url": "https://git.kernel.org/stable/c/e90346a2f1e8917d5760a44a1f61c44e3b36d96b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea3632aefc04205436868541638e26f4a74d5637"
        },
        {
          "url": "https://git.kernel.org/stable/c/6db8b56eed62baacaf37486e83378a72635c04cc"
        }
      ],
      "title": "ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43186",
    "datePublished": "2026-05-06T11:27:57.053Z",
    "dateReserved": "2026-05-01T14:12:55.991Z",
    "dateUpdated": "2026-08-05T12:26:24.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43186",
      "date": "2026-09-28",
      "epss": "0.00861",
      "percentile": "0.56891"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/ioam6.h",
                  "net/ipv6/exthdrs.c",
                  "net/ipv6/ioam6.c",
                  "net/ipv6/ioam6_iptunnel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f4d9d4b8fd839719d564651671e24c62c545c23b",
                    "status": "affected",
                    "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fb3c662fafebc5b9d74417ed1de8759f6bb72143",
                    "status": "affected",
                    "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "632d233cf2e64a46865ae2c064ae3c9df7c8864f",
                    "status": "affected",
                    "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0591d6509c2ff13f09ea2998434aba0c0472e978",
                    "status": "affected",
                    "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e90346a2f1e8917d5760a44a1f61c44e3b36d96b",
                    "status": "affected",
                    "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ea3632aefc04205436868541638e26f4a74d5637",
                    "status": "affected",
                    "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6db8b56eed62baacaf37486e83378a72635c04cc",
                    "status": "affected",
                    "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/ioam6.h",
                  "net/ipv6/exthdrs.c",
                  "net/ipv6/ioam6.c",
                  "net/ipv6/ioam6_iptunnel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.202",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.165",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B0330CE4-09CE-43EF-A9C8-CD49FFD1DC98",
                    "versionEndExcluding": "5.15.202",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654",
                    "versionEndExcluding": "6.1.165",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2",
                    "versionEndExcluding": "6.6.128",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2",
                    "versionEndExcluding": "6.12.75",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B",
                    "versionEndExcluding": "6.18.16",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                    "versionEndExcluding": "6.19.6",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace-\u003enodelen\nto decide how much data to write for each node. It trusts this field\nas-is from the incoming packet, with no consistency check against\ntrace-\u003etype (the 24-bit field that tells which data items are\npresent). A crafted packet can set nodelen=0 while setting type bits\n0-21, causing the function to write ~100 bytes past the allocated\nregion (into skb_shared_info), which corrupts adjacent heap memory\nand leads to a kernel panic.\n\nAdd a shared helper ioam6_trace_compute_nodelen() in ioam6.c to\nderive the expected nodelen from the type field, and use it:\n\n  - in ioam6_iptunnel.c (send path, existing validation) to replace\n    the open-coded computation;\n  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose\n    nodelen is inconsistent with the type field, before any data is\n    written.\n\nPer RFC 9197, bits 12-21 are each short (4-octet) fields, so they\nare included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to\n0xff1ffc00)."
          }
        ],
        "id": "CVE-2026-43186",
        "lastModified": "2026-06-17T10:49:06.890",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-06T12:16:37.300",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0591d6509c2ff13f09ea2998434aba0c0472e978"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/632d233cf2e64a46865ae2c064ae3c9df7c8864f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6db8b56eed62baacaf37486e83378a72635c04cc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e90346a2f1e8917d5760a44a1f61c44e3b36d96b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ea3632aefc04205436868541638e26f4a74d5637"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f4d9d4b8fd839719d564651671e24c62c545c23b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fb3c662fafebc5b9d74417ed1de8759f6bb72143"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-06T21:54:58+00:00",
      "cve": "CVE-2026-43186",
      "id": "CVE-2026-43186",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43186.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-08-06T01:21:07Z",
      "cve": "CVE-2026-43186",
      "id": "CVE-2026-43186",
      "initial_release_date": "2026-05-07T02:17:22Z",
      "product_status:known_not_affected": "309",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43186",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43186.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.