CVE-2026-74550
In the Linux kernel, the following vulnerability has been resolved:
net: do not send ICMP/NDISC Redirects when peer allocation fails
When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending un-rate-limited ICMP/NDISC Redirect messages.
In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL. In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into inet_peer_xrlim_allow(), which returned true when peer == NULL.
Because ICMP/NDISC Redirects are not part of the default global rate limit mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates an un-rate-limited ICMP packet storm.
Leer descripción completaMostrar menos
Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and ndisc_send_redirect() when peer is NULL.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.68%
- Percentil entre todas las CVEs puntuadas: 51
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access75 % - Impacto principal
T1499.004Application or System Exploitationimpact80 %
Vector CVSS de red sin autenticación (AV:N/AC:L/PR:N/UI:N) permite envío de paquetes ICMP/NDISC sin límite de velocidad, causando DoS por inundación de paquetes (ICMP flood).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/21666f7af49a90ef44d474916b8ef4402dfd74f5
- https://git.kernel.org/stable/c/5ec5f00fc606a6df8434948c4552b3cb1176595d
- https://git.kernel.org/stable/c/828f6670d110ff2bf44c743037b38badc315704c
- https://git.kernel.org/stable/c/c0adf8b4247bcc5a145a25c1929006eb392580bb
- https://git.kernel.org/stable/c/dbc3791e3b2472e1ccc08947e0f83b443470ff4f
- https://git.kernel.org/stable/c/f5ecaa7ea7686fa7ecdb6affc9d3a9a42e4524b1
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-74550",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"lessThan": "c0adf8b4247bcc5a145a25c1929006eb392580bb",
"versionType": "git"
},
{
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"lessThan": "f5ecaa7ea7686fa7ecdb6affc9d3a9a42e4524b1",
"versionType": "git"
},
{
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"lessThan": "21666f7af49a90ef44d474916b8ef4402dfd74f5",
"versionType": "git"
},
{
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"lessThan": "5ec5f00fc606a6df8434948c4552b3cb1176595d",
"versionType": "git"
},
{
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"lessThan": "828f6670d110ff2bf44c743037b38badc315704c",
"versionType": "git"
},
{
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"lessThan": "dbc3791e3b2472e1ccc08947e0f83b443470ff4f",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/route.c",
"net/ipv6/ip6_output.c",
"net/ipv6/ndisc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.39",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/route.c",
"net/ipv6/ip6_output.c",
"net/ipv6/ndisc.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-15T13:18:00.390",
"references": [
{
"url": "https://git.kernel.org/stable/c/21666f7af49a90ef44d474916b8ef4402dfd74f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5ec5f00fc606a6df8434948c4552b3cb1176595d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/828f6670d110ff2bf44c743037b38badc315704c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0adf8b4247bcc5a145a25c1929006eb392580bb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dbc3791e3b2472e1ccc08947e0f83b443470ff4f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f5ecaa7ea7686fa7ecdb6affc9d3a9a42e4524b1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not send ICMP/NDISC Redirects when peer allocation fails\n\nWhen inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry\nunder memory pressure or tree size caps, redirect handlers previously fell\nback to sending un-rate-limited ICMP/NDISC Redirect messages.\n\nIn IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL.\nIn IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into\ninet_peer_xrlim_allow(), which returned true when peer == NULL.\n\nBecause ICMP/NDISC Redirects are not part of the default global rate limit\nmask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates\nan un-rate-limited ICMP packet storm.\n\nFix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and\nndisc_send_redirect() when peer is NULL."
}
],
"lastModified": "2026-08-19T17:21:10.020",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}