CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Synopsis

This is a networking logic flaw in the Linux kernel's raw socket handling. A remote attacker can send a crafted ICMP packet over the network with no authentication required, and the kernel incorrectly delivers it to any open IPPROTO_RAW (protocol 255) socket, allowing the attacker to manipulate the Forwarding Next Hop Exception (FNHE) routing cache. Successful exploitation lets the attacker corrupt routing state on the host, enabling traffic redirection and denial of service. A patched-image rebuild at the fix versions (6.6.128 and 6.12.75) is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send packets to the target host over the network; no prior foothold on the machine is needed.

• AuthenticationNot required

  No credentials or account of any kind are required; the exploit is triggered by a raw crafted packet sent from any external source.

• Victim interactionNot required

  The attack is fully passive from the victim's perspective; no user action or administrator interaction is needed to trigger the vulnerable code path.

• Attack complexityDetail

  Attack complexity is low; the exploit requires only a single well-formed ICMP packet with the inner protocol field set to 255, with no race conditions or special environmental state required.

Blast Radius

• The attacker overwrites FNHE routing cache entries, redirecting outbound traffic for targeted destination prefixes through an attacker-controlled next hop.
• Corrupted FNHE entries cause Path MTU Discovery values to be poisoned, fragmenting or dropping legitimate traffic flows and producing sustained denial of service for affected destinations.
• An attacker can repeatedly send malicious ICMP packets to lock routing into a degraded state, effectively isolating the host from specific network segments without any persistent access.