CVE-2026-74597
Received Received - Intake

ip6_tunnel cb[] Clear in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74597
EUVD
EUVD-2026-64534

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ip6_tunnel module where an error handling function ip6ip6_err() incorrectly processes cloned IPv6 ICMP error packets. The issue arises when metadata from the outer packet is reused for the inner packet, leading to potential memory corruption if a malformed header is present.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or execute arbitrary code by sending specially crafted IPv6 packets. Systems using vulnerable Linux kernel versions with ip6_tunnel functionality enabled may be affected.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart