CVE-2026-74598

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: fix Route Information option length validation<br /> <br /> rt6_route_rcv() validates the Route Information option (RFC 4191) length<br /> against the prefix length, but both checks are off by one.<br /> <br /> rinfo-&gt;length is the ND option length in units of 8 octets and it<br /> *includes* the 8-byte option header, so an option carrying N bytes of<br /> prefix has length == 1 + N/8. RFC 4191 section 2.3 requires length 3<br /> when Prefix Length is greater than 64, and 2 or 3 when it is greater<br /> than 0. The code accepts length &gt;= 2 and length &gt;= 1 respectively.<br /> <br /> ipv6_addr_prefix() then copies prefix_len/8 bytes out of rinfo-&gt;prefix,<br /> so a Router Advertisement with (prefix_len=128, length=2) or<br /> (prefix_len=64, length=1) makes the kernel read up to 8 bytes past the<br /> end of the option. Those bytes end up in the prefix of the route that<br /> gets installed, so they are visible to userspace:<br /> <br /> # RA with a Route Information option (prefix_len=128, length=2)<br /> # followed by a source link-layer address option, 01 01 de ad be ef ca fe<br /> $ ip -6 route show<br /> 2001:db8:dead:beef:101:dead:beef:cafe via fe80::1234 dev veth0 proto ra<br /> ^^^^^^^^^^^^^^^^^^ the next option, read out of bounds<br /> <br /> When the Route Information option is the last one in the packet, those<br /> eight bytes come from the skb tail room instead.<br /> <br /> Reject the option lengths RFC 4191 does not allow.