CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
ipvsinicmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend(). However, IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. ipoptionsecho() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the icmpsend() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1 - Operational
Clear stale IPv4 option metadata after resetting/rebasing the network header so that IPCB(skb)->opt no longer describes the outer IPv4 header (stale location after rebase can be misinterpreted by __ip_options_echo() in the ICMP response path).
Event History
Frequently Asked Questions
What traffic conditions are required to trigger this issue?
The system must process a tunnel-related ICMP error through IPVS, where the outer IPv4 header contains a timestamp option. The ICMP packet must quote an original request such that rebasing the packet leaves the outer header's option metadata stale.
What is the potential impact of successful exploitation?
A stale IPv4 option offset can cause the ICMP response path to interpret a byte in the quoted transport header as an option length. That length is copied into fixed-size stack option storage, resulting in a stack out-of-bounds write.
What is the relevant remediation?
Apply the Linux kernel fix that clears IPv4 option metadata after IPVS resets the packet network header while processing tunnel ICMP errors. The fix retains the other packet control-block fields, including the ingress interface needed for the ICMP response path.