# CVE-2026-74598: ipv6: fix Route Information option length validation

> A flaw in Linux kernel IPv6 Route Information option validation allows attackers to read out-of-bounds memory, potentially exposing sensitive data from network packets.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 22 Aug 2026
- **Updated:** 16 Oct 2026
- **Also known as:** AZL-97214, BELL-CVE-2026-74598, DEBIAN-CVE-2026-74598, GHSA-vf8p-r5fr-wx72, UBUNTU-CVE-2026-74598

## What is CVE-2026-74598?

CVE-2026-74598 is a high-severity vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix Route Information option length validation

rt6_route_rcv() validates the Route Information option (RFC 4191) length
against the prefix length, but both checks are off by one.

rinfo->length is the ND option length in units of 8 octets and it
*includes* the 8-byte option header, so an option carrying N bytes of
prefix has length == 1 + N/8.  RFC 4191 section 2.3 requires length 3
when Prefix Length is greater than 64, and 2 or 3 when it is greater
than 0.  The code accepts length >= 2 and length >= 1 respectively.

ipv6_addr_prefix() then copies prefix_len/8 bytes out of rinfo->prefix,
so a Router Advertisement with (prefix_len=128, length=2) or
(prefix_len=64, length=1) makes the kernel read up to 8 bytes past the
end of the option.  Those bytes end up in the prefix of the route that
gets installed, so they are visible to userspace:

  # RA with a Route Information option (prefix_len=128, length=2)
  # followed by a source link-layer address option, 01 01 de ad be ef ca fe
  $ ip -6 route show
  2001:db8:dead:beef:101:dead:beef:cafe via fe80::1234 dev veth0 proto ra
                     ^^^^^^^^^^^^^^^^^^ the next option, read out of bounds

When the Route Information option is the last one in the packet, those
eight bytes come from the skb tail room instead.

Reject the option lengths RFC 4191 does not allow.

## Which versions are affected by CVE-2026-74598?


## How do I fix CVE-2026-74598?

Apply the vendor's patch.

## Is CVE-2026-74598 being exploited?

There is no known exploitation of CVE-2026-74598 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-74598 and fix it if it is affected.

What it is: CVE-2026-74598 is a high-severity vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-74598 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-74598/ (Markdown: https://insights.sbomify.com/CVE-2026-74598/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-74598
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74598
- OSV: https://osv.dev/vulnerability/CVE-2026-74598

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-74598/
Summaries are generated and may contain mistakes; the official description above is the record.