CVE-2026-74597 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb.
If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info.
Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the
reply path does not reuse metadata left by the outer IPv6 stack.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in the Linux kernel involves a critical memory corruption flaw within the ip6_tunnel module, specifically during the handling of ICMPv6 error messages for nested IPv6 tunnels. This issue arises from improper management of socket buffer control blocks when processing encapsulated traffic. When an outer IPv6 packet containing a Home Address Option triggers an error condition, the kernel function ip6ip6_err is invoked to generate and send a corresponding ICMPv6 error response back to the source. The process involves cloning the original outer packet's socket buffer, pulling the header of that clone to expose the inner quoted IPv6 packet, and then passing this modified structure to icmpv6_send for transmission.
The core technical flaw lies in the failure to clear the control block array within the cloned socket buffer before manipulating its contents. Specifically, after cloning the outer ICMP error socket buffer, the code pulls the header to access the inner packet but leaves the inet6_skb_parm data intact from the original outer packet context. If the outer packet contained a Home Address Option, the dsthao field in the control block remains set to a non-zero value representing an offset relative to the outer packet's structure. This stale metadata is not cleared or reset before the subsequent processing steps occur.
When icmpv6_send processes this socket buffer, it invokes mip6_addr_swap to handle address swapping for Mobile IPv6 scenarios. This function relies on the dsthao field to locate and manipulate the Home Address Option within the destination options header of the quoted inner packet. Because the offset stored in dsthao was calculated based on the outer packet's layout rather than the inner packet's, it points to an incorrect memory location relative to the new buffer boundaries. Consequently, if the inner destination-options header is malformed or structured differently than expected, the lookup logic may read past the end of the quoted packet data.
This out-of-bounds access leads directly to heap-based buffer overflow and corruption of the skb_shared_info structure, which holds critical metadata about the socket buffer such as fragment information and checksumming details. Corruption of this shared info block can destabilize the network stack, potentially leading to kernel panics, denial of service conditions for local or remote users depending on triggerability, or in severe cases, arbitrary code execution if an attacker can carefully craft packets to exploit specific memory layouts. The vulnerability is classified under CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write, reflecting the fundamental error in handling buffer boundaries and metadata integrity.
From a threat modeling perspective using MITRE ATT&CK, this flaw aligns with techniques related to exploitation for privilege escalation or denial of service via memory corruption, specifically falling under categories like T1499 Endpoint Denial of Service if exploited remotely to crash systems, or potentially T1055 Internal Process Discovery if the kernel panic leads to information leakage through core dumps. The lack of proper input validation and state reset in network packet processing routines is a common vector for such vulnerabilities in Linux networking subsystems.
Mitigation strategies primarily involve applying the upstream kernel patch that explicitly clears the skb2->cb array before pulling the quoted inner IPv6 packet. This ensures that any metadata from the outer stack, including stale offsets like dsthao, does not persist into the processing of the inner packet. System administrators should ensure their Linux kernels are updated to versions where this fix is included. For environments unable to patch immediately, network-level filtering can help mitigate risk by dropping malformed IPv6 packets or restricting access to tunnel endpoints from untrusted networks, thereby reducing the attack surface available for triggering the ip6ip6_err path with crafted payloads designed to exploit the stale control block data.