CVE-2026-74550

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: do not send ICMP/NDISC Redirects when peer allocation fails

When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry

under memory pressure or tree size caps, redirect handlers previously fell

back to sending un-rate-limited ICMP/NDISC Redirect messages.

In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL.

In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into

inet_peer_xrlim_allow(), which returned true when peer == NULL.

Because ICMP/NDISC Redirects are not part of the default global rate limit

mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates

an un-rate-limited ICMP packet storm.

Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and

ndisc_send_redirect() when peer is NULL.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References