Executive brief
A vulnerability was identified in the Linux kernel's networking component that handles ICMP (Internet Control Message Protocol) traffic. The issue occurs when the system processes 'Extended Echo' replies, which can cause the kernel to access memory outside of its intended boundaries. If exploited, this could lead to system instability or a crash, potentially disrupting network services and server availability.
Technical details
An out-of-bounds read vulnerability exists in net/ipv4/icmp.c within the Linux kernel. The issue stems from the introduction of RFC 8335 PROBE support, where Extended Echo replies (ICMP_EXT_ECHOREPLY) use a type value that exceeds the NR_ICMP_TYPES limit of the icmp_pointers[] array. When icmp_glue_bits() attempts to check the .error field of an entry in this array using an unvalidated type, it performs an out-of-bounds access. The fix implements a bounds check and utilizes array_index_nospec() to mitigate potential speculative execution side-channel attacks. This vulnerability is reachable via network traffic and has been patched in multiple stable kernel branches.
Affected products
- Linux Linux Kernel Fixed in 6.1.91, 6.6.31, 6.8.10, 6.9.1, and 6.10-rc1
Timeline
- 2026-04-21: other: Patch submitted by Ruide Cao
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/67bf002a2d7387a6312138210d0bd06e3cf4879b
- https://git.kernel.org/stable/c/92e7c209036dcc0e8ffdf806fdfd3645b263bea5
- https://git.kernel.org/stable/c/bc64a66e0b9ad937d3d49934242ee62b01ba9a94
- https://git.kernel.org/stable/c/c2178ff1c70ebfc2ab9651b230c58a34683db759
- https://git.kernel.org/stable/c/d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1