CVE-2026-43501

CVE-2026-43501 is a flaw in the Linux kernel IPv6 stack. It sits in the code that handles RPL source routing headers (RFC 6554, type 3). The kernel rewrites that header as a packet passes through. Sometimes the new header is bigger than the old one. The kernel did not always check that it had room for it.

When room ran short, an internal 16-bit offset wrapped around. The kernel then copied 14 bytes far past the packet buffer. KASAN reports it as an out-of-bounds write.

The Linux kernel CNA published the CVE on 21 May 2026. It scores it CVSS 3.1 9.8 (Critical). Red Hat rates it Important, with its own CVSS 3.1 score of 7.5. The weakness types are CWE-131 and CWE-787.

The flaw dates back to Linux 5.7, when RPL support landed. Fixed upstream stable releases are 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27 and 7.0.4. Mainline fixed it during the 7.1 cycle.

Nebula Security (NebuSec) named the bug "Route of Root". It is a follow-on to CVE-2023-2156 ("Route of Death"), on the same code path. NebuSec used it to win $10,500 in Google's kernelCTF. It published a write-up and exploit code in August 2026.

The CVE is not in the CISA KEV catalog. No in-the-wild exploitation is reported. ThreatWire has not run or verified the exploit. The PoC link field points to NebuSec's repository; the URL is not repeated here.