CVE-2026-43501

A flaw was found in the Linux kernel. A local attacker can exploit an out-of-bounds write vulnerability when the kernel recomputes an IPv6 Source Routing Header (SRH). This issue occurs because insufficient headroom is reserved during the recompression process, leading to memory corruption. Successful exploitation could result in a denial of service or potentially arbitrary code execution.

This is an Important flaw. A local attacker can exploit an out-of-bounds write in the Linux kernel's IPv6 Source Routing Header (SRH) recompression, which could lead to a denial of service or arbitrary code execution. This vulnerability impacts Red Hat Enterprise Linux 9 and 10, and Red Hat In-Vehicle OS 2, due to insufficient memory handling during SRH processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable IPv6 Source Routing by setting the accept_source_route sysctl parameter to 0 for all IPv6 interfaces. This can prevent the kernel from processing IPv6 Source Routing Headers, thereby avoiding the vulnerable code path.

To disable IPv6 Source Routing: sysctl -w net.ipv6.conf.all.accept_source_route=0 sysctl -w net.ipv6.conf.default.accept_source_route=0

To make this change persistent across reboots, add the following lines to /etc/sysctl.d/99-disable-ipv6-srh.conf: net.ipv6.conf.all.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0

Then, apply the changes with: sysctl --system

Disabling IPv6 Source Routing may impact network configurations that rely on this feature.