CVE-2026-74597

Received Received - Intake

ip6_tunnel cb[] Clear in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74597

EUVD

EUVD-2026-64534

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ip6_tunnel module where an error handling function ip6ip6_err() incorrectly processes cloned IPv6 ICMP error packets. The issue arises when metadata from the outer packet is reused for the inner packet, leading to potential memory corruption if a malformed header is present.

Detection Guidance

This vulnerability affects the Linux kernel's ip6_tunnel module and involves IPv6 ICMP error handling. Detection requires checking kernel logs for related errors or kernel crashes involving ip6_tunnel or IPv6 ICMP processing. Monitor for kernel oops messages or system hangs after IPv6 tunnel operations.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or execute arbitrary code by sending specially crafted IPv6 packets. Systems using vulnerable Linux kernel versions with ip6_tunnel functionality enabled may be affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel networking issue. Compliance impacts would depend on system-specific implementations and whether the vulnerability could lead to data breaches or unauthorized access, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-74597. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70