---
title: "CVE-2026-43042 — An MPLS table resize could expose an out-of-bounds route lookup"
description: "CVE-2026-43042: Linux published the new size of an MPLS route table before publishing the new table itself. A packet arriving in that small window could pass the check for the larger size and then index beyond the end of the old table. Fixed upstream in March 2026."
url: https://nebusec.ai/buglist/CVE-2026-43042/
published: 2026-09-01T00:00:00.000Z
---

CVE-2026-43042 · High

# An MPLS table resize could expose an out-of-bounds route lookup

Linux kernel · MPLS · Published Sep 01, 2026

resize_platform_label_table

* [CVSS 7.1 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-43042)
* Fixed
* Out-of-bounds-read
* Namespace required

Affects · Linux v4.1-rc1 until the fix · Debian 13 · Linux 6.12.101 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

Linux published the new size of an MPLS route table before publishing the new table itself. A packet arriving in that small window could pass the check for the larger size and then index beyond the end of the old table.

The ordering bug was introduced in March 2015 and fixed upstream in March 2026. The public exploit was later validated on Debian 13 with Linux 6.12.101.

## Why it mattered

An attacker able to resize MPLS labels and deliver packets in a network namespace could race the update. The out-of-bounds lookup could crash the kernel or turn nearby memory into an attacker-influenced pointer dereference.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`resize_platform_label_table()` updated `platform_labels` before the RCU-protected `platform_label` pointer. Lockless readers saw a mismatched pair: a new, larger bound together with the old, smaller allocation.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43042-Debian-6.12.101)

Exploit entry point · 765 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-43042-Debian-6.12.101/exploit.c#L760)

```c
    sleep(8);
    return 0;
  }
  atomic_store_explicit(&stop_flag, true, memory_order_relaxed);
  fprintf(stderr, "[-] race timed out\n");
  kill(watcher, SIGKILL);
  return 1;
}

int main(int argc, char **argv)
{
  if (argc > 1)
    return root_helper(argv[1]);
  return run_exploit();
}
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in March 2026.** The fixed update publishes a consistent size-and-table view to concurrent readers. Install a distribution kernel containing the March 2026 upstream correction.

The safest check is the distribution’s own kernel changelog for `CVE-2026-43042`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)