Skip to main content

Linux Kernel CVE-2026-46266

| EUVDEUVD-2026-34128 CRITICAL
2026-06-03 Linux GHSA-3vgg-pc24-vv5m
Information Disclosure Linux
Critical
Disputed · 9.1 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 05, 2026 - 07:29 vuln.today
CVSS changed
Jun 05, 2026 - 07:22 NVD
9.1 (CRITICAL)
Patch available
Jun 03, 2026 - 19:01 EUVD
CVE Published
Jun 03, 2026 - 15:50 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 03, 2026 - 15:50 nvd
CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous.

socket(AF_INET, SOCK_RAW, 255);

A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes.

inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST") pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner

"man 7 raw" states:

A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets.

Make sure we drop these malicious packets.

AnalysisAI

Remote manipulation of the Linux kernel's IPv4 routing cache is possible through RAW sockets bound to IPPROTO_RAW (protocol 255), where a malicious incoming ICMP packet whose inner header advertises protocol 255 will be matched to the socket and trigger FNHE (Forwarding Next Hop Exception) cache changes. The flaw affects Linux systems where a process has opened a RAW socket on protocol 255, and remote attackers can use crafted ICMP fragmentation-needed messages to influence routing decisions. No public exploit identified at time of analysis and EPSS probability is very low (0.02%), but the CVSS 9.1 reflects high integrity and availability impact via unauthenticated network reachability.

Technical ContextAI

The vulnerability lives in the Linux kernel's IPv4 RAW socket implementation (net/ipv4/raw.c). Per 'man 7 raw', a RAW socket opened with protocol IPPROTO_RAW (255) is documented as send-only - it implies IP_HDRINCL and cannot receive packets - yet the kernel's input demultiplexing path still matched incoming packets carrying protocol field 255 to such sockets. Attackers exploit this by sending an ICMP Destination Unreachable / Fragmentation Needed message (type 3 code 4) whose embedded inner IP header sets proto=255; the kernel uses the inner header to identify the originating socket and then applies the advertised next-hop MTU as a Forwarding Next Hop Exception (FNHE), poisoning the route cache. The CPE data scopes affected products to the upstream Linux kernel tree, and the bug class is closest to CWE-284 (improper access control) on the receive path, even though no CWE was assigned.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.6.128, 6.12.75, 6.18.14, 6.19.4, or later (or your distribution's backported equivalent) - the fix drops incoming packets matched against RAW sockets bound to IPPROTO_RAW, restoring the documented send-only behavior. The relevant commits are db76b75ede38, 19e42490c89b, 531c1aec81bf, 719d3932b8f6, and c89477ad7944 on git.kernel.org/stable. If immediate kernel upgrade is not possible, a compensating control is to identify and disable processes that open RAW sockets on protocol 255 (auditable with ss -elw or by inspecting /proc/net/raw for the 'Local Address' protocol field), since the flaw is only reachable while such a socket is open; the trade-off is that legitimate packet-crafting tools (scapy, hping, custom probes) will lose functionality. As a network-layer mitigation, blocking inbound ICMP type 3 code 4 (Fragmentation Needed) at the perimeter prevents the specific attack vector but breaks PMTU discovery and can cause connectivity issues with downstream MTUs below the local link.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-46266 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy