CVE-2026-74597

A flaw was found in the Linux kernel's IPv6 (Internet Protocol version 6) tunnel error handling. A remote attacker could send a specially crafted IPv6 ICMP (Internet Control Message Protocol) error packet with a malformed inner destination-options header. This could lead to memory corruption within the kernel's socket buffer shared information, potentially causing a denial of service (DoS) on the system.

This vulnerability is rated as Important because an attacker can trigger out-of-bounds memory corruption in the kernel via network-delivered ICMP error packets, potentially causing a denial of service or compromise. Exposure on Red Hat Enterprise Linux environments requires the use of IPv6-in-IPv6 tunneling, which is not configured by default on standard installations. Systems that do not terminate or process IPv6 tunnel traffic are not susceptible to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the ip6_tunnel kernel module from loading:

1. Add the module to the blacklist configuration:

echo "install ip6_tunnel /bin/true" > /etc/modprobe.d/disable-ip6_tunnel.conf

echo "blacklist ip6_tunnel" >> /etc/modprobe.d/disable-ip6_tunnel.conf

2. If the module is already loaded, attempt to unload it:

modprobe -r ip6_tunnel

Caveats: Disabling this module prevents the creation and operation of IPv6-in-IPv6 tunnels. If the ip6_tunnel module is currently in use by active network interfaces, unloading it will fail, and a system reboot will be required to apply the changes.