CVE-2026-43042

mpls: add seqcount to protect the platform_label{,s} pair

HIGH
7.1
CVSS Score
Published: May 1, 2026 at 02:15 PM UTC
Updated: October 30, 2026 at 01:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value gets passed to mpls_label_ok once more in both mpls_route_add and mpls_route_del, so there is no issue, but that additional check must not be removed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.1 ≤ v < 6.19.124.17.07.0 rc17.0 rc27.0 rc37.0 rc47.0 rc57.0 rc67720c01f3f590116882e251f13c7e1d5602f8643
Vendor states this is fixed in 5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef (fixed)
Vendor states this is fixed in 629ec78ef8608d955ce217880cdc3e1873af3a15 (fixed)
Vendor states this is fixed in 4.1 (unaffected)
Vendor states this is fixed in 6.12.114 (unaffected)
Vendor states this is fixed in 6.19.12 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-125CWE-362

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card