CVE-2026-74669
Received Received - Intake

IPv4 Options Handling Flaw in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write. Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74669
EUVD
EUVD-2026-64356

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a stack out-of-bounds write in the IPVS (IP Virtual Server) subsystem. When processing ICMP errors, the kernel rebases an skb (socket buffer) from the outer ICMP packet to the original request but fails to clear stale IPv4 option metadata. A timestamp option in the outer header can cause __ip_options_echo() to misinterpret data, leading to a buffer overflow during __icmp_send().

Detection Guidance

This vulnerability is specific to the Linux kernel's IPVS (IP Virtual Server) module and requires kernel-level inspection. Detection involves checking kernel logs for ICMP error handling issues or stack corruption events. Use commands like dmesg | grep -i icmp or journalctl -k | grep -i ipvs to search for related errors. If you suspect exploitation, monitor for kernel crashes or unusual network behavior.

Impact Analysis

This flaw could allow an attacker to execute arbitrary code or cause a denial of service by triggering a kernel panic or memory corruption. Systems using IPVS for load balancing or network services may be vulnerable if they process crafted ICMP error packets.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, disable the IPVS module if unused with modprobe -r ip_vs. For systems using IPVS, apply kernel updates as soon as they are available from your distribution vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart