CVE-2026-74669 (GCVE-0-2026-74669)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
Summary
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write. Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < 79ffa99202c944467e28b13b513bf2998732edff (git)
Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < c9413b50204738fbc429bb86bf01353c393a6c28 (git)
Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < 37c61b3745129cbd682c557b51345828120972e5 (git)
Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < ed246dd85ebf27c1f6b7897834d40786c0ca3006 (git)
Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < 6f46fc460e9316062bdcdf89199eb5d7a33da33b (git)
Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < 75eec935444db4af2123e0491936f6e273d7ea00 (git)
Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < 384b4dae14277d369221d187e9b3af56c79d2e50 (git)
Affected: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e , < e0ba936287dfe9783426aac27e5fd76fe35b38c9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "79ffa99202c944467e28b13b513bf2998732edff",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "37c61b3745129cbd682c557b51345828120972e5",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "75eec935444db4af2123e0491936f6e273d7ea00",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:24.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"
        },
        {
          "url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"
        },
        {
          "url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"
        },
        {
          "url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"
        }
      ],
      "title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74669",
    "datePublished": "2026-08-22T15:32:40.221Z",
    "dateReserved": "2026-08-15T05:44:03.924Z",
    "dateUpdated": "2026-08-25T05:41:24.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74669",
      "date": "2026-08-29",
      "epss": "0.00514",
      "percentile": "0.41583"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:46:38.000Z",
      "cve": "CVE-2026-74669",
      "id": "msrc_CVE-2026-74669",
      "initial_release_date": "2026-08-24T01:03:10.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74669.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74669\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:40.827\",\"lastModified\":\"2026-08-25T06:18:49.053\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\\n\\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\\nquoted original request before passing it to icmp_send(). However,\\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\\n\\nA timestamp option in the outer header can therefore leave an offset\\nthat points into the quoted transport header after the rebase.\\n__ip_options_echo() treats a byte at that stale location as the option\\nlength and copies it into the fixed-size option storage on the\\n__icmp_send() stack, causing a stack out-of-bounds write.\\n\\nClear the stale option metadata after resetting the network header.\\nKeep the remaining control block fields, including the ingress\\ninterface used by the ICMP response path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/ipvs/ip_vs_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"79ffa99202c944467e28b13b513bf2998732edff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"c9413b50204738fbc429bb86bf01353c393a6c28\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"37c61b3745129cbd682c557b51345828120972e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"ed246dd85ebf27c1f6b7897834d40786c0ca3006\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"6f46fc460e9316062bdcdf89199eb5d7a33da33b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"75eec935444db4af2123e0491936f6e273d7ea00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"384b4dae14277d369221d187e9b3af56c79d2e50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e\",\"lessThan\":\"e0ba936287dfe9783426aac27e5fd76fe35b38c9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/ipvs/ip_vs_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-25T06:06:54+00:00",
      "cve": "CVE-2026-74669",
      "id": "CVE-2026-74669",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74669.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.