CVE-2026-74597

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ip6 tunnel component where the ip6ip6 err() function clones an outer IPv6 ICMP error skb and pulls it to the quoted inner IPv6 packet before passing the clone to icmpv6 send(). The clone retains the outer packet's inet6 skb parm in skb->cb. If the outer packet contains a Home Address Option (HAO), the IP6CB(skb2)->dsthao remains non-zero after skb pull(). Subsequently, icmpv6 send() calls mip6 addr swap(), which applies the stale dsthao offset to the quoted inner packet. A malformed inner destination-options header can cause the HAO lookup and address swap to exceed the quoted packet boundaries, leading to the corruption of skb shared info.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.