CVE-2026-74550

Received Received - Intake

Linux Kernel ICMP/NDISC Redirect Flood Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending un-rate-limited ICMP/NDISC Redirect messages. In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL. In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into inet_peer_xrlim_allow(), which returned true when peer == NULL. Because ICMP/NDISC Redirects are not part of the default global rate limit mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates an un-rate-limited ICMP packet storm. Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and ndisc_send_redirect() when peer is NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74550

EUVD

EUVD-2026-59615

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the system sends excessive unrate-limited ICMP/NDISC Redirect messages when peer entry allocation fails due to memory pressure or tree size limits. Normally, redirects are rate-limited, but the fallback behavior bypasses this limit, causing a packet storm.

Detection Guidance

This vulnerability may cause excessive ICMP/NDISC Redirect messages during memory pressure or peer allocation failures. Monitor network traffic for unusually high rates of ICMP Redirects or NDISC Redirects using tools like tcpdump or Wireshark. Check kernel logs for allocation failures in inet_getpeer_v4() or inet_getpeer_v6().

Commands: tcpdump -i any icmp or ndisc, dmesg | grep -i peer, sysctl net.ipv4.icmp_ratelimit

Impact Analysis

This could lead to network congestion or denial-of-service conditions due to the flood of redirect messages. Systems under memory pressure may become unresponsive or experience degraded network performance.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a network packet handling issue in the Linux kernel that could lead to un-rate-limited ICMP/NDISC Redirect storms under memory pressure. Compliance impacts would only occur if such an attack disrupted system availability or data integrity, which is not specified in the provided context.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. Ensure ICMP Redirects are disabled if not required by setting sysctl net.ipv4.conf.all.accept_redirects=0 and sysctl net.ipv6.conf.all.accept_redirects=0. Monitor system memory to prevent allocation failures.

Hi! I’m here to help you understand CVE-2026-74550. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70