{"id":"CVE-2026-43042","state":"PUBLISHED","title":"mpls: add seqcount to protect the platform_label{,s} pair","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmpls: add seqcount to protect the platform_label{,s} pair\n\nThe RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have\nan inconsistent view of platform_labels vs platform_label in case of a\nconcurrent resize (resize_platform_label_table, under\nplatform_mutex). This can lead to OOB accesses.\n\nThis patch adds a seqcount, so that we get a consistent snapshot.\n\nNote that mpls_label_ok is also susceptible to this, so the check\nagainst RTA_DST in rtm_to_route_config, done outside platform_mutex,\nis not sufficient. This value gets passed to mpls_label_ok once more\nin both mpls_route_add and mpls_route_del, so there is no issue, but\nthat additional check must not be removed.","publishedAt":"2026-05-01T14:15:38.882Z","updatedAt":"2026-10-30T12:24:50.878Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"6b9184ebc936f791631e51e783ab30320b3770e4","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"0d377825548fe598595b5a5fa4a309fb593d8fb4","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"8adc5b6fc876928d8c95555d30b66fa50b07421e","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"629ec78ef8608d955ce217880cdc3e1873af3a15","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/netns/mpls.h","net/mpls/af_mpls.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.1","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.19.12","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/netns/mpls.h","net/mpls/af_mpls.c"]}],"references":["https://git.kernel.org/stable/c/6b9184ebc936f791631e51e783ab30320b3770e4","https://git.kernel.org/stable/c/0d377825548fe598595b5a5fa4a309fb593d8fb4","https://git.kernel.org/stable/c/8adc5b6fc876928d8c95555d30b66fa50b07421e","https://git.kernel.org/stable/c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef","https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-30T12:42:04.495Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43042.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43042","state":"PUBLISHED","datePublished":"2026-05-01T14:15:38.882Z","dateUpdated":"2026-10-30T12:24:50.878Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:55.978Z"},"containers":{"cna":{"title":"mpls: add seqcount to protect the platform_label{,s} pair","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmpls: add seqcount to protect the platform_label{,s} pair\n\nThe RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have\nan inconsistent view of platform_labels vs platform_label in case of a\nconcurrent resize (resize_platform_label_table, under\nplatform_mutex). This can lead to OOB accesses.\n\nThis patch adds a seqcount, so that we get a consistent snapshot.\n\nNote that mpls_label_ok is also susceptible to this, so the check\nagainst RTA_DST in rtm_to_route_config, done outside platform_mutex,\nis not sufficient. This value gets passed to mpls_label_ok once more\nin both mpls_route_add and mpls_route_del, so there is no issue, but\nthat additional check must not be removed."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"6b9184ebc936f791631e51e783ab30320b3770e4","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"0d377825548fe598595b5a5fa4a309fb593d8fb4","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"8adc5b6fc876928d8c95555d30b66fa50b07421e","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef","versionType":"git"},{"version":"7720c01f3f590116882e251f13c7e1d5602f8643","status":"affected","lessThan":"629ec78ef8608d955ce217880cdc3e1873af3a15","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/netns/mpls.h","net/mpls/af_mpls.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.1","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.19.12","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/netns/mpls.h","net/mpls/af_mpls.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6b9184ebc936f791631e51e783ab30320b3770e4"},{"url":"https://git.kernel.org/stable/c/0d377825548fe598595b5a5fa4a309fb593d8fb4"},{"url":"https://git.kernel.org/stable/c/8adc5b6fc876928d8c95555d30b66fa50b07421e"},{"url":"https://git.kernel.org/stable/c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef"},{"url":"https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The self-contained exploit path is local: the attacker races writes to /proc/sys/net/mpls/platform_labels with rtnetlink RTM_GETROUTE dumps in the same network namespace. Remote MPLS packets can reach one reader path, but a remote-only attacker cannot perform the required table resize.\nAC:L - The vulnerable condition is a race, but a local attacker can control both sides by repeatedly resizing platform_labels and issuing concurrent route dumps or packet processing. No external timing or victim state is required beyond retrying the race.\nPR:L - Writing the MPLS platform_labels sysctl requires CAP_NET_ADMIN over the target network namespace. That capability is reachable by an unprivileged user through a user namespace plus network namespace, so this is low privilege rather than high privilege.\nUI:N - No victim user action is required. The attacker can trigger the resize and reader paths directly.\nS:U - The bug is within the kernel networking/MPLS subsystem and impacts the same kernel security authority. It is not a VM escape or cross-authority boundary bypass.\nC:H - The inconsistent platform_labels/platform_label snapshot can cause out-of-bounds reads of the route pointer table and dereference attacker-influenced or adjacent kernel memory as mpls_route data. Through the route dump path this can disclose kernel memory, so confidentiality is high.\nI:N - The bug is an out-of-bounds read/dereference of the route table pointer array, not an out-of-bounds write or direct memory corruption primitive. The investigated paths do not provide a defensible arbitrary kernel data modification primitive.\nA:H - The race can make readers index a NULL, stale, or too-small platform_label array and dereference invalid pointers. This can reliably lead to kernel oops/panic or other high availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:24:50.878Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"6.19.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-43042","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:13:53.309258Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:06:10.994Z"}}]}}}