CVE-2026-74669

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ip vs in icmp() function where an skb is rebased from the outer ICMP packet to the quoted original request before being passed to icmp send(). Because IPCB(skb)->opt continues to describe the outer IPv4 header, a timestamp option in that header can leave an offset pointing into the quoted transport header after the rebase. Consequently, ip options echo() may treat a byte at this stale location as the option length and copy it into the fixed-size option storage on the icmp send() stack, leading to a stack out-of-bounds write.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.