CVE-2026-46037: Linux Kernel ICMP Reply Vulnerability

CVE-2026-46037 Overview

CVE-2026-46037 is a Linux kernel vulnerability in the IPv4 ICMP subsystem. The flaw resides in the reply-type handling logic that uses the icmp_pointers[] array without validating the input range. Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type, a value outside the range covered by icmp_pointers[], which only describes traditional ICMP types up to NR_ICMP_TYPES. The kernel maintainers resolved this by avoiding the array lookup for out-of-range reply types and applying array_index_nospec() to the remaining in-range lookup.

Critical Impact
Unvalidated array indexing in the kernel ICMP code path can lead to out-of-bounds memory access and potential speculative execution side-channel exposure.

Affected Products

Linux Kernel (IPv4 ICMP subsystem)
Distributions shipping affected upstream kernel versions
Systems processing extended ICMP echo replies (RFC 8335)

Discovery Timeline

2026-05-27 - CVE-2026-46037 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46037

Vulnerability Analysis

The vulnerability exists in the IPv4 ICMP reply handling code within the Linux kernel networking stack. The icmp_pointers[] array provides per-type metadata for traditional ICMP message types and is sized according to NR_ICMP_TYPES. Extended echo reply support introduced ICMP_EXT_ECHOREPLY as a valid outbound reply type, but its numeric value falls outside the bounds of icmp_pointers[]. When the reply path consulted the array using this out-of-range index, the access reached memory beyond the array's allocated region.

The fix introduces an explicit type-range check before consulting icmp_pointers[] and wraps the in-range lookup with array_index_nospec(). This macro clamps the index in a way that prevents speculative execution from reaching out-of-bounds offsets, hardening the code against transient execution attacks similar to Spectre v1 [CWE-1037].

Root Cause

The root cause is missing input validation of the reply type variable before it is used as an index into a fixed-size kernel array. The introduction of ICMP_EXT_ECHOREPLY expanded the set of valid reply types beyond what the original icmp_pointers[] table was designed to cover, but the indexing logic was not updated to gate the lookup behind a bounds check.

Attack Vector

The affected code path executes when the kernel constructs ICMP replies, including extended echo replies. An attacker capable of inducing the kernel to generate replies with the extended type can drive the out-of-bounds access. Because the dereferenced array entries influence reply construction, the impact ranges from disclosure of adjacent kernel memory contents to speculative side-channel leakage when array_index_nospec() is absent. Normal ICMP replies are unaffected by the fix and retain their existing behavior.

No verified public exploit code is available. See the upstream commits for technical implementation details: Linux Kernel Commit 67bf002a and Linux Kernel Commit d700c34a.

Detection Methods for CVE-2026-46037

Indicators of Compromise

Unusual volumes of inbound ICMP extended echo request traffic (RFC 8335) directed at Linux hosts
Kernel oops or KASAN reports referencing icmp_pointers or icmp_reply call sites
Unexpected kernel panics correlated with ICMP processing on edge or routing systems

Detection Strategies

Audit running kernel versions against the patched stable releases listed in the upstream commit logs
Enable CONFIG_KASAN in test environments to surface out-of-bounds reads in the ICMP path
Inspect kernel ring buffer output (dmesg) for warnings from the networking subsystem after extended ICMP probing

Monitoring Recommendations

Collect netflow and packet captures at network egress to identify anomalous ICMP type 43 (Extended Echo Request) traffic
Forward kernel logs to a central logging platform for correlation across hosts
Track kernel package versions across Linux fleet inventory to confirm patch coverage

How to Mitigate CVE-2026-46037

Immediate Actions Required

Identify all Linux systems running kernels predating the fix commits listed in the NVD references
Apply vendor-supplied kernel updates from your distribution as soon as they become available
Reboot affected hosts after kernel package installation so the new image is loaded

Patch Information

The upstream fix validates the reply type before indexing icmp_pointers[] and applies array_index_nospec() to the in-range path. The patched commits are available from the Linux stable tree: Commit 67bf002a, Commit 92e7c209, Commit bc64a66e, Commit c2178ff1, and Commit d700c34a.

Workarounds

Filter or rate-limit inbound ICMP Extended Echo Request (type 42) and Extended Echo Reply (type 43) traffic at perimeter firewalls
Use iptables or nftables rules to drop unsolicited extended ICMP traffic on hosts that do not require RFC 8335 functionality
Restrict exposure of Linux hosts to untrusted networks until the kernel is patched

bash

# Example: drop ICMP Extended Echo Request/Reply at the host
sudo nft add rule inet filter input icmp type 42 drop
sudo nft add rule inet filter input icmp type 43 drop