CVE-2026-46266

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP<br /> <br /> Yizhou Zhao reported that simply having one RAW socket on protocol<br /> IPPROTO_RAW (255) was dangerous.<br /> <br /> socket(AF_INET, SOCK_RAW, 255);<br /> <br /> A malicious incoming ICMP packet can set the protocol field to 255<br /> and match this socket, leading to FNHE cache changes.<br /> <br /> inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST")<br /> pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner<br /> <br /> "man 7 raw" states:<br /> <br /> A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able<br /> to send any IP protocol that is specified in the passed header.<br /> Receiving of all IP protocols via IPPROTO_RAW is not possible<br /> using raw sockets.<br /> <br /> Make sure we drop these malicious packets.