High [CVE-2026-74597] clear skb2->cb in ip6ip6_err
This high-severity Red Hat Linux advisory covers CVE-2026-74597 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send().
If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet.
A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack.
A flaw was found in the Linux kernel's IPv6 (Internet Protocol version 6) tunnel error handling. A remote attacker could send a specially crafted IPv6 ICMP (Internet Control Message Protocol) error packet with a malformed inner destination-options header.
This could lead to memory corruption within the kernel's socket buffer shared information, potentially causing a denial of service (DoS) on the system. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-787.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
Mitigation checklist
- Prevent the ip6_tunnel kernel module from loading: 1. Add the module to the blacklist configuration: # echo "install ip6_tunnel /bin/true" > /etc/modprobe.d/disable-ip6_tunnel.conf # echo "blacklist ip6_tunnel" >> /etc/modprobe.d/disable-ip6_tunnel.conf 2. If the module is already loaded, attempt to unload it: # modprobe -r ip6_tunnel Caveats: Disabling this module prevents the creation and operation of IPv6-in-IPv6 tunnels. If the ip6_tunnel module is currently in use by active network interfaces, unloading it will fail, and a system reboot will be required to apply the changes.
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.