Junglewise Threat Intelligence

CVE-2026-46266: Linux Kernel RAW socket ICMP handling vulnerability in inet

CVE-2026-46266 · Severity: info · CVSS 0 · Published 2026-06-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a remote attacker to interfere with network routing caches. By sending specially crafted ICMP packets, an attacker can target systems that have specific types of raw network sockets open. This could lead to unauthorized changes in how the system handles network traffic, potentially impacting network performance or stability.

Technical details

A vulnerability exists in the Linux kernel's inet implementation where RAW sockets using IPPROTO_RAW (protocol 255) do not correctly drop incoming ICMP packets. An attacker can send a malicious ICMP packet with the protocol field set to 255 to match such a socket. This interaction can lead to unauthorized Forwarding Next Hop Exception (FNHE) cache changes. The fix ensures that icmp_socket_deliver (IPv4) and icmpv6_notify (IPv6) explicitly drop packets when the next header/protocol is IPPROTO_RAW, adhering to the specification that IPPROTO_RAW sockets should not receive traffic. The issue was introduced in version 2.6.12-rc2 and has been patched in multiple stable kernel branches.

Affected products

  • Linux Linux Kernel Introduced in 2.6.12-rc2; fixed in various stable branches including 6.x and 7.0.y

Timeline

  • 2026-02-03: disclosed: Vulnerability reported and patch authored by Eric Dumazet
  • 2026-06-03: advisory: CVE-2026-46266 published in NVD

References

Related threats