Linux IPv6 RPL "Route of Root" is CVE-2026-43501, CVSS 9.8

What happened

A Linux kernel bug once filed as "crash only" turned out to give root.

CVE-2026-43501 sits in the IPv6 code for RPL source routing headers (RFC 6554). The kernel rewrites that header as it forwards the packet. The new header can come out larger than the old one. On intermediate hops, the kernel did not check it still had room.

When room ran short, a 16-bit offset wrapped around. The kernel then copied 14 bytes about 64 KB past the packet buffer. That is an out-of-bounds write in kernel memory.

This is not new. The Linux kernel CNA published the CVE on 21 May 2026, with the upstream fix. Nebula Security (NebuSec) published its "Route of Root" write-up and exploit code in August 2026. We cover it now because the public exploit keeps circulating and many kernels are still unpatched.

NebuSec says the bug is a corner case of CVE-2023-2156 ("Route of Death"). That 2023 bug hit the same code path and was treated as a denial of service. NebuSec says the 2023 fix missed this case. It used the new bug to get root in Google's kernelCTF and earned $10,500.

Who is affected

Linux kernels from 5.7 are affected until the fixed releases. Fixed upstream stable versions are 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27 and 7.0.4. Mainline fixed it in the 7.1 cycle. Distribution kernels may carry the fix under an older version number.

The vulnerable code is built in whenever IPv6 is enabled. It only runs when RPL routing is turned on through the rpl_seg_enabled sysctl. That switch is off by default.

The catch is namespaces. Changing rpl_seg_enabled needs CAP_NET_ADMIN, but only inside the current network namespace. If unprivileged user and network namespaces are enabled, a local user can get that capability in their own namespace. NebuSec says a system is exposed if it has IPv6, an affected kernel, and either RPL enabled or unprivileged namespaces available.

What is confirmed

The kernel CNA scores the flaw CVSS 3.1 9.8 (Critical). It treats the bug as reachable by a single unauthenticated network packet. Red Hat rates it Important, with CVSS 3.1 7.5. Red Hat describes a local attacker who can cause a crash or code execution. The weakness types are CWE-131 and CWE-787.

Red Hat lists fixed kernels for RHEL 9 and 10 streams. Debian and Ubuntu track the CVE on their security pages. GitHub lists it as GHSA-fqx3-r8j8-73qq.

NebuSec's exploit chain turns the 14-byte write into kernel code patching and a root shell. It relies on unprivileged user and network namespaces. NebuSec published the code in its CyberMeowfia GitHub repository. ThreatWire did not run or verify it.

The CVE is not in the CISA KEV catalog. The EPSS score is low, around 1%.

What is not confirmed

No source reports exploitation in the wild.

We found no public demonstration of remote code execution against a default system. The 9.8 score assumes network reachability. NebuSec's working chain is a local privilege escalation that needs namespaces. On hosts with RPL enabled, a remote crash may be possible. Remote code execution is not shown.

Several GitHub repositories reuse the CVE number. Some are wrappers or empty projects. One archive wrongly describes the bug as a use-after-free. Use the NebuSec source only.

What to do

Install a kernel that contains the fix or your vendor's backport. Then reboot into it. A kernel update does nothing until the host runs the new kernel.

Until then, keep rpl_seg_enabled off on all interfaces. Red Hat's mitigation is to set net.ipv6.conf.all.accept_source_route and net.ipv6.conf.default.accept_source_route to 0. Make the change persistent. This may break setups that rely on IPv6 source routing.

Where you do not need them, disable unprivileged user namespaces. This removes the local path NebuSec used. Prioritize multi-user hosts, container hosts and CI runners.

Sources: the CVE.org record, NVD, the kernel fix commit, advisories from Red Hat, Debian and Ubuntu, the GitHub advisory, and NebuSec's write-up and code. Links are in the references list.