{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-43057", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-43057" ], "published": "2026-05-01T14:17:31Z", "summary": "net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: correctly handle tunneled traffic on IPV6_CSUM GSO fallback\n\nNETIF_F_IPV6_CSUM only advertises support for checksum offload of\npackets without IPv6 extension headers. Packets with extension\nheaders must fall back onto software checksumming. Since TSO\ndepends on checksum offload, those must revert to GSO.\n\nThe below commit introduces that fallback. It always checks\nnetwork header length. For tunneled packets, the inner header length\nmust be checked instead. Extend the check accordingly.\n\nA special case is tunneled packets without inner IP protocol. Such as\nRFC 6951 SCTP in UDP. Those are not standard IPv6 followed by\ntransport header either, so also must revert to the software GSO path.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.47-1+rpt1~bookworm", "1:6.12.62-1+rpt1~bookworm", "1:6.12.75-1+rpt1~bookworm" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.47+rpt-rpi-2712", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v6", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v7", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v7l", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-2712", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v6", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v7", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v7l", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v6", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7l", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1~bookworm" } ] }, "database_specific": { "per_version": { "1:6.12.47-1+rpt1~bookworm": { "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f", "upstream_version": "6.12.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.81" }, "1:6.12.62-1+rpt1~bookworm": { "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c", "upstream_version": "6.12.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.81" }, "1:6.12.75-1+rpt1~bookworm": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.81" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.12.47-1+rpt1", "1:6.12.62-1+rpt1", "1:6.12.75-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.47+rpt-rpi-2712", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v6", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v7", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-2712", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v6", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v7", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v6", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.47-1+rpt1": { "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f", "upstream_version": "6.12.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.81" }, "1:6.12.62-1+rpt1": { "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c", "upstream_version": "6.12.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.81" }, "1:6.12.75-1+rpt1": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.81" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43057" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/2094a7cf91b71367b649f991aacc7b579f793d0b" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/ed71cf465c75f5688b07a35d373cd1d6b589c8ea" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/33670f780e0120c3dacda188c512bbffe0b6044c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a98b78116a27e2a57b696b569b2cb431c95cf9b6" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/732fdeb2987c94b439d51f5cb9addddc2fc48c42" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c4336a07eb6b2526dc2b62928b5104b41a7f81f5" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T13:16:28Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.5, "cvss_v3_severity": "High", "scenario": "AV:N - The vulnerable path is reachable through the network transmit stack when remotely supplied traffic is forwarded or tunneled by an affected Linux system. A remote peer can trigger the bad GSO/offload decision by sending suitable IPv6 tunneled traffic with extension headers through a preconfigured tunnel/router deployment.\nAC:L - There is no race or probabilistic condition; once the affected tunnel and NETIF_F_IPV6_CSUM-capable egress device are present, crafted large/GSO-eligible IPv6 traffic deterministically reaches the flawed feature check. The attacker controls the packet shape needed to hit the fallback error.\nPR:N - For the network forwarding/tunnel scenario, the attacker does not need local credentials or administrative privileges on the vulnerable host. Tunnel setup requires CAP_NET_ADMIN, but exploitation of an already deployed tunnel path is pre-authenticated network traffic.\nUI:N - No victim user action is required. The vulnerable code runs automatically during packet forwarding/transmission.\nS:U - The bug affects the kernel networking stack and availability of traffic handled by the same system. It does not cross a distinct security authority such as a guest-to-host or IOMMU boundary.\nC:N - The bug is a checksum/GSO feature-selection error and does not expose kernel memory or packet contents beyond normal transmission. No information disclosure primitive was identified.\nI:N - The issue can cause incorrect checksum/offload handling for affected packets, but it does not provide an attacker with a meaningful unauthorized data modification primitive. The practical effect is packet loss or malformed traffic rather than controlled integrity compromise.\nA:H - The related failure mode is repeated bad offload handling, warnings, packet drops, and collapse of affected tunnel throughput. A remote attacker can repeatedly trigger loss of availability for the vulnerable network path." } } }