CVE-2026-74669ipvs: clear IPv4 options after rebasing tunnel ICMP errors
- 9.8CriticalCVSS base score
- 0.51%Exploitation in 30 daysEPSS · top 56% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write. Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
Timeline
ID reserved
By Linux
- 7 days later
· 7 days later
Published
- 55 days later
· 55 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.51% · top 56% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < 79ffa99202c944467e28b13b513bf2998732edff
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < c9413b50204738fbc429bb86bf01353c393a6c28
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < 37c61b3745129cbd682c557b51345828120972e5
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < ed246dd85ebf27c1f6b7897834d40786c0ca3006
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < 6f46fc460e9316062bdcdf89199eb5d7a33da33b
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < 75eec935444db4af2123e0491936f6e273d7ea00
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < 384b4dae14277d369221d187e9b3af56c79d2e50
- affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e – < e0ba936287dfe9783426aac27e5fd76fe35b38c9
- affected 3.7
- unaffected < 3.7
- unaffected 5.10.265 – ≤ 5.10.*
- unaffected 5.15.216 – ≤ 5.15.*
- unaffected 6.1.183 – ≤ 6.1.*
- unaffected 6.6.152 – ≤ 6.6.*
- unaffected 6.12.104 – ≤ 6.12.*
- unaffected 6.18.45 – ≤ 6.18.*
- unaffected 7.1.9 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff (opens in a new tab)
- https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28 (opens in a new tab)
- https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5 (opens in a new tab)
- https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006 (opens in a new tab)
- https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b (opens in a new tab)
- https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00 (opens in a new tab)
- https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50 (opens in a new tab)
- https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-64356 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-74669)Record last updated .