CVE-2026-43341 Details

A vulnerability in the Linux kernel's IOAM6 (In-situ Operations, Administration, and Maintenance) implementation for IPv6 has been addressed. The issue arose because the function responsible for filling trace data with schema contributions used an 8-bit unsigned integer to store the length of the schema. When the largest schema payload was processed, the length calculation wrapped around, bypassing a crucial remaining-space check. This oversight allowed the function to overwrite parts of the trace buffer by copying the full schema payload and header without properly reserving space first. The vulnerability has been fixed by changing the data type of the length variable to an unsigned integer, ensuring that the full length is accurately represented and that the remaining-space check functions correctly.

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.