Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74597-98fc@gregkh/T
Public PoC/exploit code for CVE-2026-74597 has been released. Red Hat CVE: https://access.redhat.com/security/cve/cve-2026-74597 Public exploit: CentOS Stream 10 / kernel 6.12.0-264: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-74597-Centos-10-6.12.0-264 Possible backport patches: RHEL 6 through RHEL 8: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44fe898df302e91c5ee5acbc71ffa74e78e6c183 RHEL 9: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0dadb0620ab65949a8bc2439dd28ea3c942fe87d RHEL 10: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=484134e1eb07d700a73b1e4bbf3fb503e299be60 Possible mitigation for systems that do not require IPv6: grubby --update-kernel=ALL --args="ipv6.disable=1" reboot This disables the IPv6 stack and should prevent the affected IPv6 tunnel error-handling path from being reachable. Please review the affected RHEL releases, the current impact assessment, and whether disabling IPv6 at boot can be documented as a mitigation now that public exploit code is available.