CVE-2026-43083 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-43083 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-43083 is a critical out-of-bounds (OOB) memory access and missing lock vulnerability in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM6) network tracing subsystem, specifically within the trace type handling logic of the net/ioam6 component.

Technical Detail

The flaw exists in the IOAM6 trace processing code where, when the trace type bit6 flag is set, the kernel fails to properly validate memory boundaries before accessing trace data structures and does not acquire the necessary lock before operating on shared queue resources, as indicated by the truncated reference to skb_ge in the description. An attacker or a malformed network packet that triggers this code path could cause an out-of-bounds read or write in kernel memory, potentially leading to kernel memory corruption, information disclosure, or local privilege escalation depending on how the affected memory region is laid out at the time of exploitation. The missing lock condition introduces a race condition that could be independently leveraged to corrupt kernel state in multi-threaded or multi-core environments.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as none, meaning no public proof-of-concept or weaponized code has been observed or disclosed as of May 13, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns, targeted sectors, or adversary groups have been associated with this vulnerability in available intelligence sources.

What To Do

Apply the upstream Linux kernel patch resolving this vulnerability as soon as it becomes available in your distribution's stable or security update channel. Organizations running kernels with IOAM6 support enabled should treat this as a high-priority patch given the critical CVSS score of 9.1. As an interim workaround, administrators can disable IOAM6 functionality if it is not operationally required, either by removing the relevant kernel module or by blocking IOAM6-encapsulated traffic at the network perimeter. Monitor kernel security advisories from your Linux distribution vendor, including Red Hat, Ubuntu, SUSE, and Debian, for backported fixes applicable to your deployed kernel versions.