In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: validate reply type before using icmp_pointers

Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
That value is outside the range covered by icmp_pointers[], which only
describes the traditional ICMP types up to NR_ICMP_TYPES.

Avoid consulting icmp_pointers[] for reply types outside that range, and
use array_index_nospec() for the remaining in-range lookup. Normal ICMP
replies keep their existing behavior unchanged.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 affected < 92e7c209036dcc0e8ffdf806fdfd3645b263bea5
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 affected < bc64a66e0b9ad937d3d49934242ee62b01ba9a94
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 affected < c2178ff1c70ebfc2ab9651b230c58a34683db759
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 affected < d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1
d329ea5bd8845f0b196bf41b18b6173340d6e0e4 affected < 67bf002a2d7387a6312138210d0bd06e3cf4879b
Linux Linux affected
Version Status Constraints
5.13 affected —
0 unaffected < 5.13
6.6.140 unaffected ≤ 6.6.*
6.12.86 unaffected ≤ 6.12.*
6.18.27 unaffected ≤ 6.18.*
7.0.4 unaffected ≤ 7.0.*
7.1-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/67bf002a2d7387a6312138210d0bd06e3cf4879b cve-icon cve-icon
https://git.kernel.org/stable/c/92e7c209036dcc0e8ffdf806fdfd3645b263bea5 cve-icon cve-icon
https://git.kernel.org/stable/c/bc64a66e0b9ad937d3d49934242ee62b01ba9a94 cve-icon cve-icon
https://git.kernel.org/stable/c/c2178ff1c70ebfc2ab9651b230c58a34683db759 cve-icon cve-icon
https://git.kernel.org/stable/c/d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1 cve-icon cve-icon
History

Wed, 27 May 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using icmp_pointers Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES. Avoid consulting icmp_pointers[] for reply types outside that range, and use array_index_nospec() for the remaining in-range lookup. Normal ICMP replies keep their existing behavior unchanged.
Title ipv4: icmp: validate reply type before using icmp_pointers
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:56:47.795Z

Reserved: 2026-05-13T15:03:33.093Z

Link: CVE-2026-46037

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:23.027

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-46037

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T18:30:26Z

Weaknesses