CVE-2026-46037

A flaw was found in the Linux kernel, specifically within its IPv4 Internet Control Message Protocol (ICMP) component. This vulnerability occurs because the system does not properly check the type of ICMP replies before attempting to process them. An attacker could potentially exploit this by sending specially crafted extended echo replies, which might cause the system to access memory outside of its intended boundaries. This could lead to system instability, such as a crash, or potentially expose sensitive information.

This vulnerability is rated as Moderate impact because an authenticated local user can trigger an out-of-bounds array read during IPv4 ICMP extended echo reply generation, leading to a kernel crash and local denial of service. The flaw is confined to the kernel's network subsystem handling extended echo responses and does not facilitate arbitrary privilege escalation or unauthorized data modification. Red Hat Enterprise Linux 9 and 10 are impacted, whereas Red Hat Enterprise Linux 8 is unaffected due to the absence of the introducing code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.