Search: CVE-2026-74598

A vulnerability in the Linux kernel's IPv6 implementation involving incorrect validation of the Route Information option length in Router Advertisements was fixed. The flaw caused the kernel to read up to 8 bytes beyond the intended option boundary, potentially exposing kernel memory contents to userspace. This occurs due to off-by-one errors in length checks against the prefix length as defined in RFC 4191. The issue was resolved by rejecting invalid option lengths that do not conform to the RFC specification.