CVE-2026-43339

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43339", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.003Z", "datePublished": "2026-05-08T13:31:24.315Z", "dateUpdated": "2026-10-19T19:16:26.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:20.671Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible UaF in addrconf_permanent_addr()\n\nThe mentioned helper try to warn the user about an exceptional\ncondition, but the message is delivered too late, accessing the ipv6\nafter its possible deletion.\n\nReorder the statement to avoid the possible UaF; while at it, place the\nwarning outside the idev->lock as it needs no protection."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local network administration actions such as rtnetlink/sysctl-driven IPv6 address configuration and interface down/up transitions, not by remote packets.\nAC:L - A local attacker who can administer a network namespace can create the retained permanent-address state and repeatedly drive link-up restoration while inducing allocation pressure; there is no victim-controlled race required.\nPR:L - The operations require CAP_NET_ADMIN, but they are checked in the target network namespace and are reachable to an unprivileged local user via user+network namespaces on systems where those are enabled.\nUI:N - No victim user action is needed once the attacker can issue the local namespace/network configuration operations.\nS:U - The impact is within the kernel security authority; this is standard local kernel memory-safety impact rather than a cross-scope boundary such as guest-to-host escape.\nC:H - The bug dereferences a freed inet6_ifaddr and can read freed or reallocated kernel heap contents in the warning path; per the requested UAF guidance, confidentiality is High.\nI:H - Although the immediate dereference is in logging, it is a kernel heap use-after-free and the requested kernel guidance treats UAFs as potentially exploitable through heap reuse/spraying for high integrity impact.\nA:H - The freed object access can trigger a kernel fault, UAF detector report, or crash, and the local trigger can be repeated."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/addrconf.c"], "versions": [{"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "eec49a33611f20336b357b3953df44f1a02049e8", "status": "affected", "versionType": "git"}, {"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "bacc7f31085c9820922f00bc7d79756ffa13123a", "status": "affected", "versionType": "git"}, {"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "7bfafa1b0cd582983ebec6bb20f0a435528fe567", "status": "affected", "versionType": "git"}, {"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e", "status": "affected", "versionType": "git"}, {"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "25357b670afb5b517096da783abaa5cc4bf8359e", "status": "affected", "versionType": "git"}, {"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "3cd4efb5df72843dfac892d0b3c7a4a8bd926b65", "status": "affected", "versionType": "git"}, {"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1", "status": "affected", "versionType": "git"}, {"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "fd63f185979b047fb22a0dfc6bd94d0cab6a6a70", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/addrconf.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/eec49a33611f20336b357b3953df44f1a02049e8"}, {"url": "https://git.kernel.org/stable/c/bacc7f31085c9820922f00bc7d79756ffa13123a"}, {"url": "https://git.kernel.org/stable/c/7bfafa1b0cd582983ebec6bb20f0a435528fe567"}, {"url": "https://git.kernel.org/stable/c/7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e"}, {"url": "https://git.kernel.org/stable/c/25357b670afb5b517096da783abaa5cc4bf8359e"}, {"url": "https://git.kernel.org/stable/c/3cd4efb5df72843dfac892d0b3c7a4a8bd926b65"}, {"url": "https://git.kernel.org/stable/c/2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1"}, {"url": "https://git.kernel.org/stable/c/fd63f185979b047fb22a0dfc6bd94d0cab6a6a70"}], "title": "ipv6: prevent possible UaF in addrconf_permanent_addr()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:16:32.652568Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:16:26.883Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:16:32.652568Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:16:33.412Z"}}], "cna": {"title": "ipv6: prevent possible UaF in addrconf_permanent_addr()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local network administration actions such as rtnetlink/sysctl-driven IPv6 address configuration and interface down/up transitions, not by remote packets.\nAC:L - A local attacker who can administer a network namespace can create the retained permanent-address state and repeatedly drive link-up restoration while inducing allocation pressure; there is no victim-controlled race required.\nPR:L - The operations require CAP_NET_ADMIN, but they are checked in the target network namespace and are reachable to an unprivileged local user via user+network namespaces on systems where those are enabled.\nUI:N - No victim user action is needed once the attacker can issue the local namespace/network configuration operations.\nS:U - The impact is within the kernel security authority; this is standard local kernel memory-safety impact rather than a cross-scope boundary such as guest-to-host escape.\nC:H - The bug dereferences a freed inet6_ifaddr and can read freed or reallocated kernel heap contents in the warning path; per the requested UAF guidance, confidentiality is High.\nI:H - Although the immediate dereference is in logging, it is a kernel heap use-after-free and the requested kernel guidance treats UAFs as potentially exploitable through heap reuse/spraying for high integrity impact.\nA:H - The freed object access can trigger a kernel fault, UAF detector report, or crash, and the local trigger can be repeated."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "eec49a33611f20336b357b3953df44f1a02049e8", "versionType": "git"}, {"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "bacc7f31085c9820922f00bc7d79756ffa13123a", "versionType": "git"}, {"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "7bfafa1b0cd582983ebec6bb20f0a435528fe567", "versionType": "git"}, {"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e", "versionType": "git"}, {"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "25357b670afb5b517096da783abaa5cc4bf8359e", "versionType": "git"}, {"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "3cd4efb5df72843dfac892d0b3c7a4a8bd926b65", "versionType": "git"}, {"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1", "versionType": "git"}, {"status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "lessThan": "fd63f185979b047fb22a0dfc6bd94d0cab6a6a70", "versionType": "git"}], "programFiles": ["net/ipv6/addrconf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"status": "unaffected", "version": "0", "lessThan": "4.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.134", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv6/addrconf.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/eec49a33611f20336b357b3953df44f1a02049e8"}, {"url": "https://git.kernel.org/stable/c/bacc7f31085c9820922f00bc7d79756ffa13123a"}, {"url": "https://git.kernel.org/stable/c/7bfafa1b0cd582983ebec6bb20f0a435528fe567"}, {"url": "https://git.kernel.org/stable/c/7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e"}, {"url": "https://git.kernel.org/stable/c/25357b670afb5b517096da783abaa5cc4bf8359e"}, {"url": "https://git.kernel.org/stable/c/3cd4efb5df72843dfac892d0b3c7a4a8bd926b65"}, {"url": "https://git.kernel.org/stable/c/2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1"}, {"url": "https://git.kernel.org/stable/c/fd63f185979b047fb22a0dfc6bd94d0cab6a6a70"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible UaF in addrconf_permanent_addr()\n\nThe mentioned helper try to warn the user about an exceptional\ncondition, but the message is delivered too late, accessing the ipv6\nafter its possible deletion.\n\nReorder the statement to avoid the possible UaF; while at it, place the\nwarning outside the idev->lock as it needs no protection."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.134", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.81", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.22", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.12", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:20.671Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43339", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:16:26.883Z", "dateReserved": "2026-05-01T14:12:56.003Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-08T13:31:24.315Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/addrconf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "eec49a33611f20336b357b3953df44f1a02049e8", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}, {"lessThan": "bacc7f31085c9820922f00bc7d79756ffa13123a", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}, {"lessThan": "7bfafa1b0cd582983ebec6bb20f0a435528fe567", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}, {"lessThan": "7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}, {"lessThan": "25357b670afb5b517096da783abaa5cc4bf8359e", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}, {"lessThan": "3cd4efb5df72843dfac892d0b3c7a4a8bd926b65", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}, {"lessThan": "2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}, {"lessThan": "fd63f185979b047fb22a0dfc6bd94d0cab6a6a70", "status": "affected", "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/addrconf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "02FB4629-3CFA-4F2B-8699-141F5385D64A", "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible UaF in addrconf_permanent_addr()\n\nThe mentioned helper try to warn the user about an exceptional\ncondition, but the message is delivered too late, accessing the ipv6\nafter its possible deletion.\n\nReorder the statement to avoid the possible UaF; while at it, place the\nwarning outside the idev->lock as it needs no protection."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv6: prevenir posible UaF en addrconf_permanent_addr()\n\nLa funci\u00f3n auxiliar mencionada intenta advertir al usuario sobre una condici\u00f3n excepcional, pero el mensaje se entrega demasiado tarde, accediendo al ipv6 despu\u00e9s de su posible eliminaci\u00f3n.\n\nReordenar la instrucci\u00f3n para evitar el posible UaF; ya que estamos, colocar la advertencia fuera del idev -> lock, ya que no necesita protecci\u00f3n."}], "id": "CVE-2026-43339", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43339", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:16:32.652568Z", "version": "2.0.3"}}]}, "published": "2026-05-08T14:16:43.777", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/25357b670afb5b517096da783abaa5cc4bf8359e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3cd4efb5df72843dfac892d0b3c7a4a8bd926b65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7bfafa1b0cd582983ebec6bb20f0a435528fe567"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bacc7f31085c9820922f00bc7d79756ffa13123a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eec49a33611f20336b357b3953df44f1a02049e8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fd63f185979b047fb22a0dfc6bd94d0cab6a6a70"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ipv6: prevent possible UaF in addrconf_permanent_addr()", "id": "2468102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's IPv6 networking subsystem. Specifically, a Use-after-Free (UaF) vulnerability exists within the `addrconf_permanent_addr()` function. This issue arises when the system attempts to access an IPv6 address after it has been freed, which could allow an attacker to cause a denial of service or potentially execute arbitrary code."], "name": "CVE-2026-43339", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43339\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43339\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43339.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,eec49a33611f20336b357b3953df44f1a02049e8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,bacc7f31085c9820922f00bc7d79756ffa13123a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,7bfafa1b0cd582983ebec6bb20f0a435528fe567)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,25357b670afb5b517096da783abaa5cc4bf8359e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,3cd4efb5df72843dfac892d0b3c7a4a8bd926b65)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac,fd63f185979b047fb22a0dfc6bd94d0cab6a6a70)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T20:45:16.336505+00:00", "updated": "2026-05-15T13:30:45.614762+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}