CVE-2026-74669

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipvs: clear IPv4 options after rebasing tunnel ICMP errors<br /> <br /> ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the<br /> quoted original request before passing it to icmp_send(). However,<br /> IPCB(skb)-&gt;opt still describes the outer IPv4 header.<br /> <br /> A timestamp option in the outer header can therefore leave an offset<br /> that points into the quoted transport header after the rebase.<br /> __ip_options_echo() treats a byte at that stale location as the option<br /> length and copies it into the fixed-size option storage on the<br /> __icmp_send() stack, causing a stack out-of-bounds write.<br /> <br /> Clear the stale option metadata after resetting the network header.<br /> Keep the remaining control block fields, including the ingress<br /> interface used by the ICMP response path.