Out-of-bounds read in Linux kernel - CVE-2026-74598

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rt6_route_rcv() when processing a crafted IPv6 Router Advertisement containing a malformed Route Information option. A remote attacker can send a specially crafted Router Advertisement to disclose sensitive information.

When additional options follow the malformed Route Information option, data from the next option can be incorporated into the installed route and become visible to userspace.

Affected software

How to mitigate CVE-2026-74598

External References

• https://git.kernel.org/stable/c/0b9e02f3bd31c888f2ccdc0ca08e546d6abe9c4d
• https://git.kernel.org/stable/c/2f6f94eda12430fb41b24b44a71e2ea4e93561d7
• https://git.kernel.org/stable/c/3b2231e358d26e3aec5d8040b1fb777af03c5f05
• https://git.kernel.org/stable/c/7309529f257ae18e72112ef9f614edfd6df229bb
• https://git.kernel.org/stable/c/7eac87396c44a312be457ef41d4c5687883be9a2
• https://git.kernel.org/stable/c/d1ad8fb2ac6a1afb71dc22d9ae8efb4dda96c824
• https://git.kernel.org/stable/c/da64ed1f346ba84df574d6469fa2e422b2511719
• https://git.kernel.org/stable/c/ff3cb05289b8a4ef95fa7ea14c7d34818359edbb

Related Security Bulletins

• Out-of-bounds read in Linux kernel ipv6
• Debian update for linux