The Linux kernel vulnerability CVE-2026-74669 affects the ipvs subsystem's handling of ICMP errors in tunneled packets. Specifically, ip_vs_in_icmp() rebases the skb from the outer ICMP packet to the quoted original request but leaves the IPCB(skb)->opt field pointing to the outer IPv4 header options. If the outer header contains a timestamp option, this stale pointer can cause __ip_options_echo() to read an incorrect option length byte from a location inside the quoted transport header. This leads to a stack out-of-bounds write in __icmp_send(), potentially corrupting kernel memory. The vulnerability was fixed by clearing the stale IPv4 option metadata after resetting the network header while preserving other control block fields.

This vulnerability could lead to a stack out-of-bounds write in kernel memory during ICMP error processing in the ipvs subsystem. Such memory corruption could potentially cause system instability or be leveraged for privilege escalation or denial of service. However, no known exploits in the wild have been reported. The impact is limited to systems running the vulnerable Linux kernel with ipvs enabled and processing tunneled ICMP errors with IPv4 options.

A fix has been implemented in the Linux kernel to clear stale IPv4 option metadata after rebasing the skb in ip_vs_in_icmp(). Users should apply the official kernel updates that include this patch. Since no patch links or vendor advisories are provided here, users should monitor the official Linux kernel mailing lists or distribution security advisories for the relevant fixed kernel versions. Patch status is not yet confirmed in this data — check the vendor advisory for current remediation guidance.