CVE-2026-43042
MPLS Label Table Race Condition in Linux Kernel
Publication date: 2026-05-01
Last updated on: 2026-05-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's MPLS (Multiprotocol Label Switching) implementation. Specifically, the codepaths protected by RCU (Read-Copy-Update), such as mpls_forward and mpls_dump_routes, can have an inconsistent view of platform_labels versus platform_label during a concurrent resize operation of the platform_label_table. This inconsistency can lead to out-of-bounds (OOB) memory accesses.
The issue arises because the resize operation is protected by a mutex (platform_mutex), but the RCU-protected codepaths do not have a consistent snapshot of the data during this resize. To fix this, a sequence counter (seqcount) was added to ensure a consistent snapshot is obtained, preventing OOB accesses.
Additionally, the function mpls_label_ok is also susceptible to this inconsistency, so certain checks outside the mutex are not sufficient on their own. The patch ensures these checks remain intact to avoid issues.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory accesses in the Linux kernel's MPLS code. Such memory errors can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service.
Because the issue involves concurrent access and resizing of kernel data structures, it could be exploited to compromise system reliability or security, especially on systems using MPLS features.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in the Linux kernel related to inconsistent views of platform_labels during concurrent resize operations has been resolved by adding a seqcount to ensure consistent snapshots.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this patch which protects the platform_label pairs with seqcount.