CVE-2026-74598

A flaw was found in the Linux kernel's IPv6 networking stack. An off-by-one error in the validation of the Route Information option length (RFC 4191) allows a remote attacker to craft a Router Advertisement (RA) packet. This crafted packet can cause the kernel to read up to 8 bytes beyond the intended buffer. These out-of-bounds bytes can then be exposed to userspace, leading to information disclosure.

An off-by-one validation bug in IPv6 Router Advertisement Route Information option handling can make rt6_route_rcv accept an option that is shorter than RFC 4191 allows. ipv6_addr_prefix then copies prefix bytes beyond the end of the option, so up to 8 adjacent bytes can be read and embedded into the installed IPv6 route prefix. For the CVSS the PR:N is used because the attacker does not need privileges on the victim host and only needs the ability to send Router Advertisements on the same L2 segment. The issue is adjacent-network reachable rather than Internet-routable because IPv6 Router Advertisements are link-local control traffic. Impact is limited information disclosure and possible routing state manipulation. Availability impact is low in the paranoid score because malformed RA-installed routes may degrade connectivity, but the patch supports an OOB read primitive rather than UAF, OOB write, or arbitrary write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.