CVE-2026-74597

In the Linux kernel, the following vulnerability has been resolved:

ip6tunnel: clear skb2->cb[] in ip6ip6err()

ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the

quoted inner IPv6 packet, and then passes the clone to icmpv6_send().

The clone still carries the outer packet's inet6skbparm in skb->cb.

If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao

remains non-zero after skbpull(). icmpv6send() later calls

mip6addrswap(), which uses that stale dsthao offset against the quoted

inner packet. A malformed inner destination-options header can then make

the HAO lookup and address swap run past the end of the quoted packet

and corrupt skbsharedinfo.

Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the

reply path does not reuse metadata left by the outer IPv6 stack.