RHSA-2026:28742CriticalCVSS 8.8

Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update

Published
June 24, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-43037 →

📋 Description

CVE-2026-43037 — kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

🎯 Affected products7

  • Red Hat Enterprise Linux BaseOS (v. 10)
  • kpatch-patch-6_12_0-211_16_1-0:1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kpatch-patch-6_12_0-211_16_1-0:1-1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kpatch-patch-6_12_0-211_16_1-0:1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kpatch-patch-6_12_0-211_16_1-debuginfo-0:1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kpatch-patch-6_12_0-211_16_1-debuginfo-0:1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kpatch-patch-6_12_0-211_16_1-debugsource-0:1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is to skip loading the affected module `ip6_tunnel` onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ We may also want to detection and monitoring an affected system as below: ~~~ Monitor for exploitation attempts: # Enable kernel audit for IPv6 tunnel operations auditctl -a always,exit -F arch=b64 -S socket -F a0=10 -F a1=3 -k ipv6_tunnel # Monitor system logs for kernel panics/crashes journalctl -k -p err -f | grep -i "ip6_tunnel\|icmp\|stack" ~~~

🔗 References (4)