AZL-97091
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97091.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-97091
- Upstream
- Published
- 2026-08-22T16:16:40Z
- Modified
- 2026-08-29T05:27:27Z
- Summary
- CVE-2026-74669 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
ipvsinicmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend(). However, IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ipoptionsecho() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the _icmpsend() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
- References