Executive brief
The Linux kernel's IPv6 tunnel implementation contains a memory safety flaw in its error handling path. When processing malformed IPv6 ICMP error packets, the kernel can corrupt memory structures used for packet metadata, potentially allowing a remote attacker to trigger a denial of service or achieve code execution on systems with IPv6 networking enabled.
Technical details
The vulnerability exists in the ip6ip6_err() function in net/ipv6/ip6_tunnel.c, which handles IPv6 ICMP error responses. When cloning an outer IPv6 ICMP error packet to extract the quoted inner IPv6 packet, the function failed to clear the control buffer (skb->cb) containing the outer packet's metadata (inet6_skb_parm). If the outer packet contained a Home Address Option, the stale dsthao offset remained in the cloned packet's metadata. When icmpv6_send() later called mip6_addr_swap() using this stale offset on the inner packet, a malformed destination-options header could cause the address swap to read and write past packet boundaries, corrupting skb_shared_info. The fix adds a memset() to clear skb2->cb[] before processing the inner packet, preventing metadata reuse from the outer packet stack.
Affected products
- Linux Linux kernel 2.6.11 through 6.x (all stable series prior to patch)
Timeline
- 2026-08-22: disclosed: CVE-2026-74597 published
- 2026-08-19: patched: Patch merged to stable kernel trees by Greg Kroah-Hartman
- 2026-08-03: other: Fix commit authored by Zhiling Zou