A flaw was found in the Linux kernel's Multiprotocol Label Switching (MPLS) module. This vulnerability is caused by a race condition where concurrent operations on network label data can lead to inconsistent memory access. This can result in out-of-bounds memory reads or writes, potentially causing system instability or a denial of service.
In the Linux kernel, the following vulnerability has been resolved:
mpls: add seqcount to protect the platform_label{,s} pair
The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have
an inconsistent view of platform_labels vs platform_label in case of a
concurrent resize (resize_platform_label_table, under
platform_mutex). This can lead to OOB accesses.
This patch adds a seqcount, so that we get a consistent snapshot.
Note that mpls_label_ok is also susceptible to this, so the check
against RTA_DST in rtm_to_route_config, done outside platform_mutex,
is not sufficient. This value gets passed to mpls_label_ok once more
in both mpls_route_add and mpls_route_del, so there is no issue, but
that additional check must not be removed.
FYI regarding CVE-2026-43042:
A public exploit for CVE-2026-43042 has been released by NebuSec, targeting Debian with kernel 6.12.101:
https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43042-Debian-6.12.101
A demonstration video of the public exploit has also been published:
https://x.com/cybermeowfia/status/2094999904892645569
The video appears to demonstrate successful exploitation of CVE-2026-43042.
For RHEL 8 through RHEL 10, the following Linux stable commit appears to be relevant as a backport reference:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef
I also checked the MPLS Makefile:
obj-$(CONFIG_NET_MPLS_GSO) += mpls_gso.o
obj-$(CONFIG_MPLS_ROUTING) += mpls_router.o
obj-$(CONFIG_MPLS_IPTUNNEL) += mpls_iptunnel.o
mpls_router-y := af_mpls.o
Therefore, when CONFIG_MPLS_ROUTING is configured as a module and MPLS routing is not required, a possible mitigation may be to prevent the mpls_router module from loading:
echo "install mpls_router /bin/true" > /etc/modprobe.d/disable-mpls_router.conf
This mitigation would not apply if MPLS routing support is built directly into the kernel. In that case, applying the patched kernel remains necessary.
In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value gets passed to mpls_label_ok once more in both mpls_route_add and mpls_route_del, so there is no issue, but that additional check must not be removed.