External risk intelligence

Linux Kernel IPv6 Tunneling Vulnerability Corrupts Shared Memory

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74597

The vulnerability exists in the Linux kernel's IPv6 tunneling (ip6_tunnel) implementation, specifically handling ICMP error packets. While this code processes network traffic and is theoretically reachable via packets sent to a system, it requires specific tunnel configurations to be active and exposed, making internet-wide reachability possible but not a common default deployment for all systems.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability could allow an attacker to corrupt memory related to IPv6 tunneling when handling error messages. While the specific conditions for exploitation are complex, the potential impact is severe, affecting system integrity and availability.

An IPv6 tunnel issue can corrupt system memory.
It has a critical rating, indicating high risk.
Confirm relevance to our specific IPv6 tunnel configurations.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending specially crafted IPv6 packets to a system running a vulnerable Linux kernel. The system must have IPv6 tunneling enabled, allowing the kernel to process these packets. The vulnerability lies in how the kernel handles ICMP error messages related to IPv6-in-IPv6 tunnels, potentially leading to memory corruption when processing a malformed inner packet.

Network-accessible packets trigger vulnerability.
Vulnerable component processes ICMP error packets.
Risk of memory corruption and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to corrupt critical kernel memory when processing specially crafted IPv6 ICMP error packets within an IP6-in-IP6 tunnel. This corruption could lead to denial of service or potentially allow for code execution when specific conditions related to IPv6 Home Address Options are met.

Kernel memory corruption.
Malicious ICMP error packets.
System instability or compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability within the Linux kernel's IPV6 tunneling code impacts core network functionality. Infrastructure or platform teams are likely responsible for managing the kernel, while network and security teams should assess exposure and coordinate remediation. The first practical step is to identify any systems running vulnerable kernel versions, determine if the IPV6 tunneling functionality is active and exposed to external networks, and then prioritize based on risk and potential business impact.

Infrastructure teams own the issue.
Verify IPV6 tunnel exposure and reachability.
Plan kernel updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel's ip6_tunnel component?

The ip6_tunnel component is a networking subsystem in the Linux kernel that enables IPv6-in-IPv6 tunneling. This technology allows administrators to encapsulate IPv6 packets within other IPv6 packets, commonly used to route traffic across networks that do not natively support IPv6 or to create virtual private network links between infrastructure nodes.

How does CVE-2026-74597 cause memory corruption?

The vulnerability stems from an error in metadata handling. When the kernel processes ICMP error messages for tunnels, it clones packet information. If it fails to clear existing metadata—specifically regarding Home Address Options—from the cloned packet's control buffer, the system may apply incorrect offsets to the inner packet. This mistake allows the kernel to read or write past the intended memory boundaries, leading to corruption of shared kernel information.

What triggers this vulnerability in the Linux kernel?

An attacker triggers this by sending a specially crafted IPv6-in-IPv6 ICMP error packet to the host. The vulnerability is specific to the handling of these error messages; it is not triggered by standard, well-formed IPv6 traffic. Crucially, the system must have IPv6 tunneling actively configured to process these packets for the flaw to be relevant.

How do I know if my systems are at risk?

According to Halo Surface Signal, this vulnerability is classified as external, meaning it is reachable over a network. However, risk depends on your specific architecture. You should prioritize systems that are internet-facing and actively use IPv6 tunneling, as these are the primary targets for the malformed packets described. Internal systems with tunnels configured but isolated from the public internet have a lower immediate reachability profile.

What is the first step to address CVE-2026-74597?

Your first step is to inventory your infrastructure to identify which systems are running a vulnerable kernel and have the IPv6 tunnel functionality enabled. Once identified, coordinate with your infrastructure or platform teams to plan for a kernel update. Since this affects core networking code, ensure you review your current tunnel configurations to understand your specific exposure while preparing for the patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.