{"apiVersion":"1.0","identifier":"CVE-2026-74597","description":"In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet-s inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack.","publishedAt":"2026-08-22T16:16:32","lastModifiedAt":"2026-08-25T06:18:35","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74597","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00514,"riskScore":1.03,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74597","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74597","en":"https://www.redsauce.net/en/cves/CVE-2026-74597","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74597","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74597","de":"https://www.redsauce.net/de/cves/CVE-2026-74597","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74597","el":"https://www.redsauce.net/el/cves/CVE-2026-74597"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74597"}}