CVE-2026-46037

ipv4: icmp: validate reply type before using icmp_pointers

State: Published
Severity: 8.2 High
Published: May 27, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: validate reply type before using icmp_pointers

Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES.

Avoid consulting icmp_pointers[] for reply types outside that range, and use array_index_nospec() for the remaining in-range lookup. Normal ICMP replies keep their existing behavior unchanged.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 93df2af4f491de33827550b9d420f01808c0706bAffected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 92e7c209036dcc0e8ffdf806fdfd3645b263bea5Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before bc64a66e0b9ad937d3d49934242ee62b01ba9a94Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before c2178ff1c70ebfc2ab9651b230c58a34683db759Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1Affected d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 67bf002a2d7387a6312138210d0bd06e3cf4879bAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.86 through 6.12.Not affected 6.18.27 through 6.18.Not affected 7.0.4 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 93df2af4f491de33827550b9d420f01808c0706bAffected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 92e7c209036dcc0e8ffdf806fdfd3645b263bea5Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before bc64a66e0b9ad937d3d49934242ee62b01ba9a94Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before c2178ff1c70ebfc2ab9651b230c58a34683db759Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1Affected
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to before 67bf002a2d7387a6312138210d0bd06e3cf4879bAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.86 through 6.12.*Not affected
6.18.27 through 6.18.*Not affected
7.0.4 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.