Linux: Vulnerability CVE-2026-43037
Early in May 2026, a critical vulnerability was discovered in the Linux kernel that, under certain circumstances, could allow attackers to force a remote Linux server to execute malicious code (remote code execution, RCE) without needing to know any login credentials. Linux clients are theoretically also affected, but in practice they are rarely the target of an attack.
This vulnerability is identified as CVE-2026-43037 and affects the ip6_tunnel module of the Linux kernel. The severity score (CVSS) is defined differently by various sources. The kernel developers rate it at 9.8, while others rate it at 9.2 or 8.8. As of June 12, 2026, no public exploit code for this vulnerability has been published.
Linux distributions
This vulnerability has existed for many years, meaning that all major Linux distributions were affected by it. The information below regarding the availability of updates reflects the status as of mid-June 2026. Click the links provided to access the latest information on released updates.
Red Hat Enterprise Linux (RHEL)
Updates are available for current versions
- RHEL 8, 9, and 10:
Kernel updates are available and should be installed - RHEL 6 and 7:
Updates are not yet available.
Ubuntu
Updates have not yet been released.
- Ubuntu 26.04 LTS:
Not affected according to Ubuntu - Ubuntu 22.04 LTS, 24.04 LTS:
Update is still pending
Debian
Workaround
In cases where updated kernel packages are not available or a reboot is not possible currently, a workaround is available to prevent the affected module, ip6_tunnel, from loading. In most cases, Linux servers can operate without this module.
On most Linux distributions, you can prevent the module from loading (as root) using commands such as the following:
echo 'install ip6_tunnel /bin/false' > /etc/modprobe.d/CVE-2026-43037.conf
rmmod ip6_tunnel 2>/dev/null
Even after applying the workaround, available kernel updates should be installed as soon as possible.
To undo the workaround after a secure kernel version has been installed and activated via a reboot, the previously created modprobe file is deleted:
/bin/rm /etc/modprobe.d/CVE-2026-43037.conf