CVE-2026-74669 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in the Linux kernel's IP Virtual Server (IPVS) subsystem represents a critical memory safety flaw rooted in improper handling of IPv4 options during packet rebasing operations. Specifically, within the ip_vs_in_icmp function, which processes incoming Internet Control Message Protocol packets related to tunneling scenarios, the system attempts to rebase an sk_buff structure from the outer ICMP wrapper back to the context of the quoted original request before invoking icmp_send. This process is essential for correctly generating error responses that reflect the internal network topology rather than the external encapsulation headers. However, a failure occurs in the cleanup phase where the IPv4 control block metadata associated with options remains stale after the network header pointer is updated. The IPCB macro retrieves option data from this control block, and because it was not cleared during the rebasing process, it continues to reference fields belonging to the outer IPv4 header rather than the newly exposed inner packet structure.
This oversight leads directly to a stack-based buffer overflow when specific ICMP error types are processed. If the original outer packet contained an IPv4 timestamp option, the stale metadata retains an offset pointing into what is now interpreted as part of the quoted transport header after rebasing. When __ip_options_echo executes during the icmp_send routine, it interprets a byte at this incorrect memory location as the length field for IP options. Consequently, the function proceeds to copy data based on this erroneous length value into a fixed-size buffer allocated on the kernel stack within __icmp_send. This action results in a stack out-of-bounds write, allowing an attacker who can trigger such ICMP error conditions to overwrite adjacent stack memory with arbitrary values derived from network traffic.
The operational impact of this vulnerability is severe due to its potential for remote code execution and denial of service. Since the flaw occurs during the processing of inbound packets that elicit ICMP errors, it can be exploited remotely by sending crafted UDP or TCP packets through an IPVS-managed load balancer configured with tunneling modes such as IPIP or GRE. Successful exploitation allows a malicious actor to corrupt kernel stack memory, which may lead to arbitrary code execution with root privileges if the overwritten data includes return addresses or function pointers. Even without achieving full code execution, the corruption of kernel state can cause system instability, leading to kernel panics and service outages for all services relying on the affected IPVS configuration. This aligns with CWE-121, which classifies stack-based buffer overflows as a critical category of memory safety violations that compromise data integrity and confidentiality within privileged execution contexts.
From an offensive security perspective, this vulnerability maps to MITRE ATT&CK technique T1059, specifically command scripting or system commands if code execution is achieved, but more accurately reflects the initial access vector through exploitation of network services. The attack path involves crafting specific ICMP error-inducing packets that traverse IPVS tunneling endpoints, leveraging the kernel's own packet processing logic against itself to gain unauthorized control over the host operating system. This highlights a common class of issues in high-performance networking code where performance optimizations or assumptions about header structures are not rigorously validated during state transitions like rebasing.
Mitigation strategies must focus on both immediate patching and architectural hardening. The primary remediation is applying the upstream Linux kernel fix that explicitly clears IPv4 option metadata after resetting the network header pointer in ip_vs_in_icmp, while preserving other necessary control block fields such as ingress interface information required for proper ICMP response routing. Organizations running vulnerable versions of the Linux kernel should prioritize updating to patched releases immediately. Additionally, deploying network segmentation and strict firewall rules can limit exposure by restricting access to IPVS endpoints from untrusted networks. Implementing intrusion detection systems that monitor for anomalous ICMP traffic patterns or malformed IPv4 options may also provide early warning indicators of exploitation attempts in environments where immediate patching is not feasible.