Executive brief
The Linux kernel's IPv6 networking stack incorrectly validates the length of Route Information options in Router Advertisements, allowing a remote attacker to craft malicious network packets that trigger an out-of-bounds memory read. The kernel copies more data than allocated, exposing sensitive kernel memory to the attacker or potentially causing a crash. This affects systems receiving IPv6 Router Advertisements from the network, including routers and end hosts.
Technical details
The vulnerability is an off-by-one error in rt6_route_rcv() in net/ipv6/route.c that validates RFC 4191 Route Information option lengths. The code checks rinfo->length (in 8-octet units including the 8-byte header) against prefix length using incorrect thresholds: accepting length >= 2 instead of >= 3 when prefix_len > 64, and length >= 1 instead of >= 2 when 0 < prefix_len <= 64. This allows malformed Router Advertisements to pass validation. The subsequent ipv6_addr_prefix() call then reads prefix_len/8 bytes from rinfo->prefix, causing out-of-bounds reads of 1–8 bytes depending on the prefix length. The exposed memory is incorporated into the installed route and visible to userspace, or comes from skb tail room if the option is terminal in the packet. No authentication is required; the attack is triggered by receiving a crafted IPv6 Router Advertisement on the network. The patch enforces strict RFC 4191 compliance by rejecting invalid option lengths.
Affected products
- Linux Linux Kernel 2.6.11 through 7.2 and later (all versions with IPv6 Route Information support)
Timeline
- 2026-08-22: disclosed: CVE-2026-74598 published
- 2026-08-19: patched: Fix merged by Greg Kroah-Hartman to stable trees