Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value gets passed to mpls_label_ok once more in both mpls_route_add and mpls_route_del, so there is no issue, but that additional check must not be removed.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026050104-CVE-2026-43042-8e66@gregkh/T
FYI regarding CVE-2026-43042: A public exploit for CVE-2026-43042 has been released by NebuSec, targeting Debian with kernel 6.12.101: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43042-Debian-6.12.101 A demonstration video of the public exploit has also been published: https://x.com/cybermeowfia/status/2094999904892645569 The video appears to demonstrate successful exploitation of CVE-2026-43042. For RHEL 8 through RHEL 10, the following Linux stable commit appears to be relevant as a backport reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef I also checked the MPLS Makefile: obj-$(CONFIG_NET_MPLS_GSO) += mpls_gso.o obj-$(CONFIG_MPLS_ROUTING) += mpls_router.o obj-$(CONFIG_MPLS_IPTUNNEL) += mpls_iptunnel.o mpls_router-y := af_mpls.o Therefore, when CONFIG_MPLS_ROUTING is configured as a module and MPLS routing is not required, a possible mitigation may be to prevent the mpls_router module from loading: echo "install mpls_router /bin/true" > /etc/modprobe.d/disable-mpls_router.conf This mitigation would not apply if MPLS routing support is built directly into the kernel. In that case, applying the patched kernel remains necessary.