CVE-2026-43083 is a vulnerability in the Linux kernel's ioam6 network tracing feature where an out-of-bounds access of the dev->_tx[] array can occur when trace->type.bit6 is set and the packet is on the RX path. The root cause is that skb_get_tx_queue() does not clamp the queue index, which can exceed the number of TX queues if the ingress device has more RX queues than the egress device has TX queues. Additionally, a missing lock around qdisc_qstats_qlen_backlog() was identified and fixed. The vulnerability affects multiple Linux kernel versions prior to 6.17.0-1026.26 and related Ubuntu kernel packages. Ubuntu security advisories USN-8490-1 and USN-8491-1 provide details and fixes. The vulnerability has a CVSS 3.1 score of 9.1 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and availability.

Successful exploitation could lead to out-of-bounds memory access in kernel space, potentially causing system crashes or denial of service. The vulnerability does not indicate direct code execution or privilege escalation but can compromise system stability and confidentiality due to memory corruption. The CVSS score of 9.1 reflects high impact on confidentiality and availability. No known exploits in the wild have been reported.

A patch is available and should be applied promptly. Ubuntu has released updated Linux kernel packages (e.g., linux-image-6.17.0-1018-oracle 6.17.0-1018.18 and others) that fix this vulnerability. After applying the update, a system reboot is required to activate the fixes. Due to an ABI change in the kernel update, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor's official advisories USN-8490-1 and USN-8491-1 for detailed update instructions. No additional mitigations are specified by the vendor.