CVE-2026-74598

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the rt6 route rcv() function incorrectly validates the length of the Route Information option (RFC 4191) against the prefix length due to off-by-one errors. The rinfo->length variable, which represents the Neighbor Discovery (ND) option length in 8-octet units including the header, is not strictly validated. Consequently, a specially crafted Router Advertisement with specific prefix len and length combinations can cause the ipv6 addr prefix() function to read up to 8 bytes beyond the end of the option. This out-of-bounds read allows data from subsequent options or the socket buffer (skb) tail room to be incorporated into the installed route prefix, making the leaked information visible to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.