9.8

CVE-2026-74669: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-74669DEBIAN-CVE-2026-74669
Published 22-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-74669 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 27 · Related 23
MGASA-2026-0506OPENSUSE-SU-2026:21910-1RHSA-2026:75746RHSA-2026:75747RHSA-2026:76739SUSE-SU-2026:23477-1

Timeline

  1. 22-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write. Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

0.00 pp

From 0.51% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.9-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < 79ffa99202c944467e28b13b513bf2998732edff | ≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < c9413b50204738fbc429bb86bf01353c393a6c28 | ≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < 37c61b3745129cbd682c557b51345828120972e5 | ≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < ed246dd85ebf27c1f6b7897834d40786c0ca3006 | ≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < 6f46fc460e9316062bdcdf89199eb5d7a33da33b | ≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < 75eec935444db4af2123e0491936f6e273d7ea00 | ≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < 384b4dae14277d369221d187e9b3af56c79d2e50 | ≥ f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e, < e0ba936287dfe9783426aac27e5fd76fe35b38c9 | 3.7

3 vendors · 172 products

References

18 links
Show all 18 references