CVE-2026-74598: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74598 Overview

CVE-2026-74598 is an out-of-bounds read vulnerability in the Linux kernel IPv6 stack. The flaw resides in rt6_route_rcv(), which handles the Route Information option defined by RFC 4191 in IPv6 Router Advertisements. The function validates the option length against the prefix length using off-by-one checks, allowing crafted Router Advertisements to bypass length validation. When the kernel processes such a message, ipv6_addr_prefix() copies memory past the end of the option, embedding out-of-bounds bytes into an installed route. Those bytes become visible to userspace through the routing table, resulting in kernel memory disclosure over the network.

Critical Impact
A remote attacker on the local IPv6 link can trigger disclosure of adjacent kernel memory by sending a malformed Router Advertisement, leaking data into userspace-visible route entries.

Affected Products

Linux kernel (IPv6 subsystem, net/ipv6/route.c)
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Systems processing IPv6 Router Advertisements (default behavior on most Linux hosts)

Discovery Timeline

2026-08-22 - CVE-2026-74598 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74598

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the IPv6 neighbor discovery code path that handles RFC 4191 Route Information options. The rinfo->length field is expressed in units of 8 octets and includes the 8-byte option header itself. RFC 4191 section 2.3 mandates a length of 3 when the Prefix Length is greater than 64, and either 2 or 3 when the Prefix Length is greater than 0. The kernel implementation instead accepted length values of >= 2 and >= 1 respectively, an off-by-one condition on both bounds.

Root Cause

When rt6_route_rcv() accepts an undersized option, ipv6_addr_prefix() proceeds to copy prefix_len/8 bytes out of rinfo->prefix. A Router Advertisement carrying (prefix_len=128, length=2) or (prefix_len=64, length=1) causes the kernel to read up to 8 bytes beyond the end of the option buffer. Those out-of-bounds bytes are written into the prefix of the newly installed route, where userspace can retrieve them with ip -6 route show.

Attack Vector

An attacker with the ability to send IPv6 Router Advertisements on a link segment can transmit a crafted RA to a victim host. If the malformed Route Information option is followed by another option, such as the source link-layer address, the trailing option bytes are copied into the route entry. When the Route Information option is the last option in the packet, the trailing bytes are read from the socket buffer tail room, potentially exposing residual kernel memory. Because IPv6 RA processing is enabled by default on typical Linux systems, no authentication is required.

// No verified exploit code available. See kernel commit references for the
// fix that rejects Route Information option lengths not permitted by RFC 4191.

Detection Methods for CVE-2026-74598

Indicators of Compromise

IPv6 Router Advertisement packets containing Route Information options with length=1 and prefix_len > 0, or length=2 and prefix_len > 64
Route entries visible in ip -6 route show where the low-order bits of the prefix do not match the advertised network topology
Unexpected proto ra IPv6 routes appearing on hosts that should not accept RAs from untrusted segments

Detection Strategies

Deploy IPv6 RA Guard on switching infrastructure to block unauthorized Router Advertisements at layer 2
Inspect captured IPv6 ND traffic with tools such as tcpdump or Wireshark, filtering for ICMPv6 type 134 with Route Information options (option type 24) and validating length fields against RFC 4191
Alert on installations of unexpected IPv6 routes with proto ra on servers and workstations via configuration monitoring

Monitoring Recommendations

Ingest IPv6 neighbor discovery telemetry and routing table changes into a centralized data lake for correlation across endpoints
Baseline the set of legitimate IPv6 routers on each subnet and alert on Router Advertisements originating from any other link-local address
Track kernel version inventory to identify hosts still running pre-patch stable branches

How to Mitigate CVE-2026-74598

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix rejecting non-conformant Route Information option lengths
Enable RA Guard or equivalent layer 2 filtering on access switches to block spoofed Router Advertisements
Restrict which interfaces accept Router Advertisements by tuning net.ipv6.conf.<iface>.accept_ra where RAs are not required

Patch Information

The upstream fix updates rt6_route_rcv() to reject Route Information option lengths that RFC 4191 does not allow. The change is distributed across multiple stable branches. Refer to the corresponding kernel commits: 0b9e02f, 2f6f94e, 3b2231e, 7309529, 7eac873, d1ad8fb, da64ed1, and ff3cb05.

Workarounds

Disable IPv6 Router Advertisement acceptance on hosts that do not require SLAAC by setting net.ipv6.conf.all.accept_ra=0 and net.ipv6.conf.default.accept_ra=0
Configure static IPv6 routing where feasible so that malicious RAs cannot install routes
Deploy IPv6 RA Guard, DHCPv6 Shield, or ACLs at the network edge to drop untrusted ICMPv6 type 134 traffic

bash

# Disable acceptance of IPv6 Router Advertisements on all interfaces
sudo sysctl -w net.ipv6.conf.all.accept_ra=0
sudo sysctl -w net.ipv6.conf.default.accept_ra=0

# Persist the setting across reboots
echo 'net.ipv6.conf.all.accept_ra=0' | sudo tee -a /etc/sysctl.d/99-ipv6-ra.conf
echo 'net.ipv6.conf.default.accept_ra=0' | sudo tee -a /etc/sysctl.d/99-ipv6-ra.conf
sudo sysctl --system

# Verify current kernel version against patched stable branch
uname -r