CVE-2026-74597
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the ip6ip6_err() function clones an outer IPv6 ICMP error skb and passes it to icmpv6_send() without clearing the outer packet's metadata in skb->cb. This can lead to out-of-bounds access on the quoted inner packet and corruption of skb_shared_info.
Risk Assessment
A remote attacker can send a crafted IPv6 packet, causing kernel memory corruption, potentially leading to system crash or code execution.
Recommendation
Install the kernel update that clears skb2->cb[] before processing the quoted inner packet.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack.