CVE-2026-46037 ipv4: icmp: validate reply type before using icmp_pointers
A missing bounds check in the Linux kernel's ICMP handling allows out-of-bounds memory reads, potentially leading to information disclosure or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46037?
CVE-2026-46037 is a high-severity memory corruption vulnerability in Linux kernel, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: icmp: validate reply type before using icmp_pointers
Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES.
Avoid consulting icmp_pointers[] for reply types outside that range, and use array_index_nospec() for the remaining in-range lookup. Normal ICMP replies keep their existing behavior unchanged.
Weakness: CWE-125
Which versions are affected by CVE-2026-46037?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46037?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-46037 being exploited?
There is no known exploitation of CVE-2026-46037 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88671, BELL-CVE-2026-46037, DEBIAN-CVE-2026-46037, GHSA-hxj2-jf3v-xp24, ROOT-OS-DEBIAN-12-CVE-2026-46037, ROOT-OS-UBUNTU-2204-CVE-2026-46037 and 2 more.