Answer in brief
CVE-2026-74669 records a Unknown severity vulnerability in ipvs: clear IPv4 options after rebasing tunnel ICMP errors. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <79ffa99202c944467e28b13b513bf2998732edff || >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <c9413b50204738fbc429bb86bf01353c393a6c28 || >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <37c61b3745129cbd682c557b51345828120972e5 || >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <ed246dd85ebf27c1f6b7897834d40786c0ca3006 || >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <6f46fc460e9316062bdcdf89199eb5d7a33da33b || >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <75eec935444db4af2123e0491936f6e273d7ea00 || >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <384b4dae14277d369221d187e9b3af56c79d2e50 || >=f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e <e0ba936287dfe9783426aac27e5fd76fe35b38c9 | 79ffa99202c944467e28b13b513bf2998732edff, c9413b50204738fbc429bb86bf01353c393a6c28, 37c61b3745129cbd682c557b51345828120972e5, ed246dd85ebf27c1f6b7897834d40786c0ca3006, 6f46fc460e9316062bdcdf89199eb5d7a33da33b, 75eec935444db4af2123e0491936f6e273d7ea00, 384b4dae14277d369221d187e9b3af56c79d2e50, e0ba936287dfe9783426aac27e5fd76fe35b38c9 |
| Linux/Linuxgeneric | 3.7 | Not reported |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write. Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
Quoted source text, attributed separately from HOL analysis.