CVE-2026-74597

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ip6_tunnel: clear skb2-&gt;cb[] in ip6ip6_err()<br /> <br /> ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the<br /> quoted inner IPv6 packet, and then passes the clone to icmpv6_send().<br /> The clone still carries the outer packet&amp;#39;s inet6_skb_parm in skb-&gt;cb.<br /> <br /> If the outer packet had a Home Address Option, IP6CB(skb2)-&gt;dsthao<br /> remains non-zero after skb_pull(). icmpv6_send() later calls<br /> mip6_addr_swap(), which uses that stale dsthao offset against the quoted<br /> inner packet. A malformed inner destination-options header can then make<br /> the HAO lookup and address swap run past the end of the quoted packet<br /> and corrupt skb_shared_info.<br /> <br /> Clear skb2-&gt;cb[] before pulling the quoted inner IPv6 packet so the<br /> reply path does not reuse metadata left by the outer IPv6 stack.