CVE-2026-74669

ipvs: clear IPv4 options after rebasing tunnel ICMP errors

State: Published
Severity: 9.8 Critical
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear IPv4 options after rebasing tunnel ICMP errors

ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header.

A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write.

Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 79ffa99202c944467e28b13b513bf2998732edffAffected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before c9413b50204738fbc429bb86bf01353c393a6c28Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 37c61b3745129cbd682c557b51345828120972e5Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before ed246dd85ebf27c1f6b7897834d40786c0ca3006Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 6f46fc460e9316062bdcdf89199eb5d7a33da33bAffected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 75eec935444db4af2123e0491936f6e273d7ea00Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 384b4dae14277d369221d187e9b3af56c79d2e50Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before e0ba936287dfe9783426aac27e5fd76fe35b38c9Affected
LinuxLinux	3.7Affected before 3.7Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 79ffa99202c944467e28b13b513bf2998732edffAffected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before c9413b50204738fbc429bb86bf01353c393a6c28Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 37c61b3745129cbd682c557b51345828120972e5Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before ed246dd85ebf27c1f6b7897834d40786c0ca3006Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 6f46fc460e9316062bdcdf89199eb5d7a33da33bAffected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 75eec935444db4af2123e0491936f6e273d7ea00Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 384b4dae14277d369221d187e9b3af56c79d2e50Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before e0ba936287dfe9783426aac27e5fd76fe35b38c9Affected

LinuxLinux

3.7Affected
before 3.7Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.