CVE-2026-74669

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74669", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.924Z", "datePublished": "2026-08-22T15:32:40.221Z", "dateUpdated": "2026-10-16T19:16:08.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:41:24.114Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)->opt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "versions": [{"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "79ffa99202c944467e28b13b513bf2998732edff", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "37c61b3745129cbd682c557b51345828120972e5", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "75eec935444db4af2123e0491936f6e273d7ea00", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"}, {"url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"}, {"url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"}, {"url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"}, {"url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"}, {"url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"}, {"url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"}, {"url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"}], "title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:21.602938Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:08.572Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74669", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.924Z", "datePublished": "2026-08-22T15:32:40.221Z", "dateUpdated": "2026-10-16T19:16:08.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:41:24.114Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)->opt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "versions": [{"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "79ffa99202c944467e28b13b513bf2998732edff", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "37c61b3745129cbd682c557b51345828120972e5", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "75eec935444db4af2123e0491936f6e273d7ea00", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50", "status": "affected", "versionType": "git"}, {"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"}, {"url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"}, {"url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"}, {"url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"}, {"url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"}, {"url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"}, {"url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"}, {"url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"}], "title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:21.602938Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:14:22.447Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "79ffa99202c944467e28b13b513bf2998732edff", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}, {"lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}, {"lessThan": "37c61b3745129cbd682c557b51345828120972e5", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}, {"lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}, {"lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}, {"lessThan": "75eec935444db4af2123e0491936f6e273d7ea00", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}, {"lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}, {"lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9", "status": "affected", "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/ipvs/ip_vs_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)->opt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipvs: limpiar opciones IPv4 despu\u00e9s de rebasar errores ICMP de t\u00fanel\n\nip_vs_in_icmp() reajusta un skb desde el paquete ICMP externo a la solicitud original citada antes de pasarlo a icmp_send(). Sin embargo, IPCB(skb) -> opt a\u00fan describe la cabecera IPv4 externa.\n\nUna opci\u00f3n de marca de tiempo en la cabecera externa puede, por lo tanto, dejar un desplazamiento que apunta hacia la cabecera de transporte citada despu\u00e9s del reajuste. __ip_options_echo() trata un byte en esa ubicaci\u00f3n obsoleta como la longitud de la opci\u00f3n y lo copia en el almacenamiento de opciones de tama\u00f1o fijo en la pila de __icmp_send(), causando una escritura fuera de l\u00edmites de la pila.\n\nLimpiar los metadatos de opci\u00f3n obsoletos despu\u00e9s de restablecer la cabecera de red. Mantener los campos restantes del bloque de control, incluyendo la interfaz de entrada utilizada por la ruta de respuesta ICMP."}], "id": "CVE-2026-74669", "lastModified": "2026-10-16T20:17:51.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74669", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:14:21.602938Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:40.827", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors", "id": "2521375", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521375"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. When processing Internet Control Message Protocol (ICMP) errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet, leading to a stack out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution."], "name": "CVE-2026-74669", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74669\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74669\nhttps://lore.kernel.org/linux-cve-announce/2026082229-CVE-2026-74669-f574@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,79ffa99202c944467e28b13b513bf2998732edff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,c9413b50204738fbc429bb86bf01353c393a6c28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,37c61b3745129cbd682c557b51345828120972e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,ed246dd85ebf27c1f6b7897834d40786c0ca3006)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,6f46fc460e9316062bdcdf89199eb5d7a33da33b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,75eec935444db4af2123e0491936f6e273d7ea00)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,384b4dae14277d369221d187e9b3af56c79d2e50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e,e0ba936287dfe9783426aac27e5fd76fe35b38c9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.265,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T19:00:14.811846+00:00", "updated": "2026-08-25T07:45:04.230368+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}