CVE-2026-74597: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74597 Overview

CVE-2026-74597 is a Linux kernel vulnerability in the IPv6 tunnel (ip6_tunnel) subsystem. The flaw resides in the ip6ip6_err() handler, which processes ICMPv6 errors for IPv6-in-IPv6 tunnels. The function clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and passes the clone to icmpv6_send() without clearing skb2->cb[]. Stale metadata from the outer packet, specifically the dsthao field in IP6CB(skb2), can then be reused against the inner packet. A malformed inner destination-options header can trigger an out-of-bounds access that corrupts skb_shared_info.

Critical Impact
A remote attacker can send crafted IPv6 ICMP error packets containing a Home Address Option and a malformed inner destination-options header to corrupt kernel memory in skb_shared_info, enabling denial of service or potential remote code execution against systems running IPv6-in-IPv6 tunnels.

Affected Products

Linux kernel — IPv6 tunneling (ip6_tunnel) subsystem
Distributions shipping unpatched Linux kernels with CONFIG_IPV6_TUNNEL enabled
Systems configured with ip6ip6 tunnels or Mobile IPv6 support

Discovery Timeline

2026-08-22 - CVE-2026-74597 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74597

Vulnerability Analysis

The vulnerability is an out-of-bounds read and write [CWE-125/CWE-787] in the IPv6-in-IPv6 tunnel ICMP error handling path. When an ICMPv6 error is received for an ip6ip6 tunnel, ip6ip6_err() clones the outer error skb and calls skb_pull() to advance the data pointer past the outer IPv6 header to the quoted inner IPv6 packet. The clone retains the outer packet's inet6_skb_parm control block in skb->cb. If the outer packet carried a Home Address Option (HAO), the field IP6CB(skb2)->dsthao holds a non-zero offset referring to the outer packet layout. After the pull, that offset no longer describes the buffer, but the value remains in place.

The kernel then hands the clone to icmpv6_send(), which invokes mip6_addr_swap() as part of Mobile IPv6 reply processing. mip6_addr_swap() uses the stale dsthao offset to locate a HAO inside what it now treats as an outbound packet header. With a crafted malformed inner destination-options header, the HAO lookup and subsequent source address swap can read and write past the end of the quoted packet, corrupting adjacent memory including skb_shared_info.

Root Cause

The root cause is a failure to reset per-packet metadata when repurposing an skb. The control block skb->cb[] is protocol-scoped scratch space. Pulling the buffer to a new protocol layer without clearing cb[] allows outer-layer parser state, specifically IP6CB()->dsthao, to be misinterpreted by inner-layer consumers. The fix clears skb2->cb[] before the skb_pull() so the reply path cannot reuse metadata left by the outer IPv6 stack.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker sends a crafted ICMPv6 error message to a Linux host that terminates an ip6ip6 tunnel. The outer IPv6 header carries a Home Address Option to set a non-zero dsthao. The quoted inner packet embeds a malformed destination-options header designed to steer the stale dsthao offset into attacker-influenced bytes. Processing the error triggers the out-of-bounds HAO swap and skb_shared_info corruption. Fix commits are tracked upstream, including Kernel Commit 0dadb06 and Kernel Commit 484134e.

// No verified public exploit code is available.
// The vulnerability is described in prose above.
// See upstream kernel commits for the corrective patch.

Detection Methods for CVE-2026-74597

Indicators of Compromise

Unexpected kernel oops, BUG: messages, or KASAN reports referencing mip6_addr_swap, icmpv6_send, or ip6ip6_err in dmesg.
Sudden crashes or reboots on hosts terminating ip6ip6 tunnels shortly after receiving inbound ICMPv6 errors.
Anomalous ICMPv6 Parameter Problem or Destination Unreachable messages targeting tunnel endpoints and carrying Home Address Options.

Detection Strategies

Inventory hosts loading the ip6_tunnel module and running kernels prior to the fix commits listed under git.kernel.org stable tree.
Inspect IPv6 flows for ICMPv6 error packets containing Type 2 Routing Headers or Home Address Options directed at tunnel endpoints.
Correlate kernel crash telemetry with inbound ICMPv6 traffic patterns to identify probe-then-crash sequences.

Monitoring Recommendations

Forward kernel logs and crash dumps to a central analytics platform and alert on stack traces containing mip6_addr_swap or ip6ip6_err.
Enable IDS signatures that flag ICMPv6 errors quoting inner packets with malformed destination-options headers.
Track module load events for ip6_tunnel and mip6 across the fleet to scope exposure.

How to Mitigate CVE-2026-74597

Immediate Actions Required

Upgrade to a Linux kernel that includes one of the upstream fix commits, such as Kernel Commit 44fe898 or Kernel Commit fbf40fa.
On hosts that do not require IPv6-in-IPv6 tunneling, unload the ip6_tunnel module and blacklist it to remove the vulnerable code path.
Apply distribution-provided kernel updates once available and reboot affected systems.

Patch Information

The upstream fix clears skb2->cb[] before pulling the quoted inner IPv6 packet in ip6ip6_err(), preventing reuse of outer-packet inet6_skb_parm state. Fix commits are available across stable branches, including Kernel Commit 0dadb06, Kernel Commit 4eb15c4, Kernel Commit 64e4173, Kernel Commit b681653, and Kernel Commit f803c08.

Workarounds

Filter inbound ICMPv6 error messages that carry Type 2 Routing Headers or Home Address Options at perimeter and host firewalls where Mobile IPv6 is not in use.
Restrict ip6ip6 tunnel endpoints to trusted peer addresses using ip6tables or nftables rules.
Disable Mobile IPv6 functionality by ensuring mip6 is not loaded on hosts that do not require it.

bash

# Prevent the vulnerable module from loading on systems that do not need it
echo 'install ip6_tunnel /bin/true' | sudo tee /etc/modprobe.d/disable-ip6tunnel.conf
sudo rmmod ip6_tunnel 2>/dev/null || true

# Drop inbound ICMPv6 errors from untrusted sources at the host firewall
sudo nft add rule inet filter input meta l4proto ipv6-icmp \
  icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } \
  ip6 saddr != @trusted_peers drop