CVE-2026-74550
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In the Linux kernel network stack, when peer entry allocation (inet_getpeer_v4/v6) fails, functions sending ICMP/NDISC Redirects sent packets without rate limiting, potentially leading to a packet storm. The fix prevents sending redirects when peer is NULL.
Risk Assessment
A remote attacker can exploit this to generate a large number of ICMP/NDISC packets, potentially causing network congestion or DoS.
Recommendation
Install the kernel patch that prevents sending redirects when peer allocation fails.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending un-rate-limited ICMP/NDISC Redirect messages. In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL. In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into inet_peer_xrlim_allow(), which returned true when peer == NULL. Because ICMP/NDISC Redirects are not part of the default global rate limit mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates an un-rate-limited ICMP packet storm. Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and ndisc_send_redirect() when peer is NULL.