CVE-2026-43341

A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM6) trace fill functionality. An integer overflow vulnerability exists in the ioam6_fill_trace_data() function, where the schema length calculation can wrap around due to being stored in an 8-bit unsigned integer. This bypasses buffer size checks, leading to a buffer overflow that can result in a denial of service or other memory corruption issues.

An IPv6 IOAM trace buffer overflow can occur because the schema length contribution is stored in an 8 bit value. With bit 22 enabled and the largest schema payload, sclen wraps from 256 to 0, bypassing the remaining space check while the code still copies the schema header and payload past the trace buffer. The issue is network reachable, although practical exposure is usually limited to IOAM enabled domains or trusted IPv6 networks rather than the public Internet. Impact is kernel memory corruption through an out of bounds write and may cause denial of service or in worst case confidentiality and integrity impact. For the Red Hat Enterprise Linux before 10 is not actual, because not introduced yet (the Fixes patch 8c6f6fa6772696be0c047a711858084b38763728 not applied yet).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.