Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-46037

ipv4: icmp: validate reply type before using icmp_pointers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using icmp_pointers Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES. Avoid consulting icmp_pointers[] for reply types outside that range, and use array_index_nospec() for the remaining in-range lookup. Normal ICMP replies keep their existing behavior unchanged.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to < b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99affected
  • d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to < 93df2af4f491de33827550b9d420f01808c0706baffected
  • d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to < 92e7c209036dcc0e8ffdf806fdfd3645b263bea5affected
  • d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to < bc64a66e0b9ad937d3d49934242ee62b01ba9a94affected
  • d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to < c2178ff1c70ebfc2ab9651b230c58a34683db759affected
  • d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to < d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1affected
  • d329ea5bd8845f0b196bf41b18b6173340d6e0e4 to < 67bf002a2d7387a6312138210d0bd06e3cf4879baffected

Linux Linux

Default version status: affected

  • 5.13affected
  • 0 to < 5.13unaffected
  • 5.15.209 to ≤ 5.15.*unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.140 to ≤ 6.6.*unaffected
  • 6.12.86 to ≤ 6.12.*unaffected
  • 6.18.27 to ≤ 6.18.*unaffected
  • 7.0.4 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References