CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear IPv4 options after rebasing tunnel ICMP errors

ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
quoted original request before passing it to icmp_send(). However,
IPCB(skb)->opt still describes the outer IPv4 header.

A timestamp option in the outer header can therefore leave an offset
that points into the quoted transport header after the rebase.
__ip_options_echo() treats a byte at that stale location as the option
length and copies it into the fixed-size option storage on the
__icmp_send() stack, causing a stack out-of-bounds write.

Clear the stale option metadata after resetting the network header.
Keep the remaining control block fields, including the ingress
interface used by the ICMP response path.

The Linux kernel CVE team has assigned CVE-2026-74669 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 5.10.265 with commit 79ffa99202c944467e28b13b513bf2998732edff
	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 5.15.216 with commit c9413b50204738fbc429bb86bf01353c393a6c28
	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 6.1.183 with commit 37c61b3745129cbd682c557b51345828120972e5
	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 6.6.152 with commit ed246dd85ebf27c1f6b7897834d40786c0ca3006
	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 6.12.104 with commit 6f46fc460e9316062bdcdf89199eb5d7a33da33b
	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 6.18.45 with commit 75eec935444db4af2123e0491936f6e273d7ea00
	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 7.1.9 with commit 384b4dae14277d369221d187e9b3af56c79d2e50
	Issue introduced in 3.7 with commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e and fixed in 7.2 with commit e0ba936287dfe9783426aac27e5fd76fe35b38c9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74669
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/ipvs/ip_vs_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff
	https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28
	https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5
	https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006
	https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b
	https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00
	https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50
	https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9