CVE-2026-74597: ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the
quoted inner IPv6 packet, and then passes the clone to icmpv6_send().
The clone still carries the outer packet's inet6_skb_parm in skb->cb.

If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao
remains non-zero after skb_pull(). icmpv6_send() later calls
mip6_addr_swap(), which uses that stale dsthao offset against the quoted
inner packet. A malformed inner destination-options header can then make
the HAO lookup and address swap run past the end of the quoted packet
and corrupt skb_shared_info.

Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the
reply path does not reuse metadata left by the outer IPv6 stack.

The Linux kernel CVE team has assigned CVE-2026-74597 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 5.10.265 with commit 44fe898df302e91c5ee5acbc71ffa74e78e6c183
	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 5.15.216 with commit 0dadb0620ab65949a8bc2439dd28ea3c942fe87d
	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 6.1.183 with commit b6816536a2990c0db44a26130a03e40b441e829b
	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 6.6.152 with commit 64e41736a26f37ab6215bc2e6df125df05aceb08
	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 6.12.104 with commit 484134e1eb07d700a73b1e4bbf3fb503e299be60
	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 6.18.45 with commit 4eb15c465337b18f44716c499cd6ad63eee0ad54
	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 7.1.9 with commit fbf40faa0414b753212494ad197542002e66ed9e
	Issue introduced in 2.6.22 with commit e490d1d85cf5e191791979e5f260d32eb4f703a8 and fixed in 7.2 with commit f803c086399da277b5d0ff36a107d0f162751800

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74597
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/ip6_tunnel.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/44fe898df302e91c5ee5acbc71ffa74e78e6c183
	https://git.kernel.org/stable/c/0dadb0620ab65949a8bc2439dd28ea3c942fe87d
	https://git.kernel.org/stable/c/b6816536a2990c0db44a26130a03e40b441e829b
	https://git.kernel.org/stable/c/64e41736a26f37ab6215bc2e6df125df05aceb08
	https://git.kernel.org/stable/c/484134e1eb07d700a73b1e4bbf3fb503e299be60
	https://git.kernel.org/stable/c/4eb15c465337b18f44716c499cd6ad63eee0ad54
	https://git.kernel.org/stable/c/fbf40faa0414b753212494ad197542002e66ed9e
	https://git.kernel.org/stable/c/f803c086399da277b5d0ff36a107d0f162751800