CVE-2026-74669

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write. Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5
https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50
https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b
https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00
https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff
https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28
https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9
https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-22 16:16

Updated : 2026-08-25 06:18

NVD link : CVE-2026-74669

Mitre link : CVE-2026-74669

CVE.ORG link : CVE-2026-74669

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74669", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "79ffa99202c944467e28b13b513bf2998732edff", "versionType": "git"}, {"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28", "versionType": "git"}, {"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "37c61b3745129cbd682c557b51345828120972e5", "versionType": "git"}, {"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006", "versionType": "git"}, {"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b", "versionType": "git"}, {"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "75eec935444db4af2123e0491936f6e273d7ea00", "versionType": "git"}, {"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50", "versionType": "git"}, {"status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9", "versionType": "git"}], "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"status": "unaffected", "version": "0", "lessThan": "3.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "defaultStatus": "affected"}]}], "published": "2026-08-22T16:16:40.827", "references": [{"url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)->opt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."}], "lastModified": "2026-08-25T06:18:49.053", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}