CVE-2026-46266

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTO_RAW. A remote attacker could send a specially crafted ICMP (Internet Control Message Protocol) packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for IPPROTO_RAW. This leads to unintended FNHE (Flow N-tuple Hash Entry) cache changes, which could result in unexpected network behavior.

Incoming ICMP or ICMPv6 error processing could incorrectly treat an embedded protocol value of IPPROTO_RAW as deliverable to a local raw socket. A remote attacker can send a crafted ICMP error with an inner IP header using protocol 255 and may cause FNHE route cache changes, such as route exception or PMTU state changes, when a matching IPPROTO_RAW socket exists on the target. For the CVSS the PR:N is used because the remote sender does not need privileges on the victim host, although reliable triggering depends on a local process having created an IPPROTO_RAW raw socket. The issue is network reachable but has an important environmental precondition, so AC:H is used. Impact is mainly denial of service and low integrity impact through route cache manipulation, not memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.