CVE-2026-46266

What it actually does

The flaw is in Linux kernel IPv4 raw-socket handling. A raw socket opened with IPPROTO_RAW is intended for sending arbitrary IP packets, not for receiving all protocols. A crafted incoming ICMP error packet can embed an inner IPv4 header whose protocol field is 255, causing the packet to incorrectly match an existing IPPROTO_RAW socket. When processed, the kernel can apply forwarding/next-hop exception cache changes, such as path MTU or route exception updates, based on attacker-controlled packet contents. The likely impact is integrity and availability loss through manipulation of networking state; this is not a code-execution or data-disclosure issue.

Why it matters to the business

An unauthenticated network attacker may be able to disrupt or manipulate network connectivity on vulnerable Linux systems that have an IPPROTO_RAW socket open, affecting applications, appliances, containers, monitoring tools, or network services that rely on stable routing and packet delivery. The CVSS score is high, but the current EPSS is low, the issue is not in CISA KEV, and no public exploit maturity was reported, so remediation should be prioritized for Internet-facing, routing-sensitive, or container-heavy Linux deployments rather than treated as confirmed widespread exploitation.

How an attack unfolds

An attacker first needs a vulnerable Linux kernel host where some process has opened an IPv4 raw socket using socket(AF_INET, SOCK_RAW, IPPROTO_RAW). That capability is normally restricted to privileged processes or processes with CAP_NET_RAW, but such sockets may be used by packet generators, diagnostics, network agents, custom services, containers granted raw networking capability, or security tools. The attacker then sends crafted ICMP error traffic to the host. The ICMP packet contains an embedded inner IPv4 packet whose protocol field is set to 255, matching IPPROTO_RAW. Because vulnerable kernels fail to drop this case, the packet can be associated with the raw socket path and cause attacker-influenced forwarding/next-hop exception cache changes, such as path MTU updates. By choosing embedded source, destination, and MTU-related values, and by repeating the packet, the attacker can poison kernel network exception state and degrade, break, or alter connectivity for affected flows. There is no indication that this vulnerability directly grants shell access or leaks memory; the primary risk is remote network-state manipulation and denial of service.

How to fix it

Upgrade to a Linux kernel version that includes the upstream fix ensuring incoming ICMP packets are dropped for IPPROTO_RAW raw sockets. No exact fixed package versions were provided in the input, so use distribution vendor advisories for the affected kernel stream and install the latest security kernel update from the relevant vendor. Reboot into the updated kernel after patching; live patching should only be considered sufficient if the vendor explicitly states this specific networking fix is covered. As compensating controls, restrict CAP_NET_RAW and privileged container use, remove unnecessary raw-socket-capable tools or daemons, filter suspicious ICMP error traffic at network boundaries where operationally safe, and monitor for ICMP fragmentation-needed packets containing an embedded IPv4 protocol value of 255.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version, not just the installed package version, after reboot. Compare the running kernel against the vendor advisory or upstream commit that drops malicious ICMP packets for IPPROTO_RAW. In a controlled lab, create a raw socket using IPPROTO_RAW on a vulnerable test host and send a crafted ICMP type 3/code 4 packet containing an inner IPv4 header with protocol 255; a fixed kernel should not apply the malicious FNHE/path-MTU cache change. Operationally, validate that no unnecessary processes or containers retain CAP_NET_RAW and that packet captures or network IDS rules can identify ICMP error packets with embedded IP protocol 255.

Typical attack path

1. Find or assume a Linux target running a vulnerable kernel.
2. Identify a plausible condition where a privileged process or container may have opened an IPv4 raw socket with IPPROTO_RAW.
3. Send crafted ICMP error packets to the target, commonly ICMP destination-unreachable/fragmentation-needed messages.
4. Embed an inner IPv4 header in the ICMP payload with the protocol field set to 255.
5. Set inner source/destination and MTU-related values to influence the kernel route or next-hop exception cache.
6. Repeat the traffic to maintain or broaden corrupted network exception state.
7. Observe degraded connectivity, altered path MTU behavior, packet drops, or service disruption.

How to detect it

Look for evidence of crafted ICMP error packets targeting Linux systems, especially ICMP destination unreachable type 3/code 4 messages that contain an embedded IPv4 header with protocol value 255. Useful sources include perimeter firewall logs, router ACL logs, Zeek/Suricata/IDS telemetry, full packet capture, NetFlow enriched with ICMP type/code, host packet captures, and Linux audit or EDR telemetry showing processes with CAP_NET_RAW or raw socket creation. Investigate repeated ICMP fragmentation-needed messages from unexpected external sources, packets with suspiciously low next-hop MTU values such as 576, and timing correlations with sudden path MTU changes, route exception changes, retransmission spikes, application timeouts, or asymmetric connectivity failures. On hosts, identify processes with CAP_NET_RAW and review recent privileged container launches or network tools that could have opened IPPROTO_RAW sockets. Because kernel route exception changes may not leave durable logs by default, packet capture and network sensor telemetry are the most reliable retrospective evidence.

• socket(AF_INET, SOCK_RAW, 255)
• socket(AF_INET, SOCK_RAW, IPPROTO_RAW)
• IPPROTO_RAW
• ICMP type 3 code 4
• Destination Unreachable (Fragmentation needed)
• Frag needed and DF set
• protocol 255
• proto=255
• nexthopmtu=576
• IP(src="192.168.2.1", dst="8.8.8.8", proto=255)
• ICMP(type=3, code=4, nexthopmtu=576)
• ip[9] == 1 and icmp[0] == 3 and icmp[1] == 4
• embedded IPv4 protocol 255

What your security team should do

• Prioritize patching Linux systems that are Internet-facing, perform routing/network functions, run privileged containers, or host tools likely to use raw sockets.
• Inventory use of CAP_NET_RAW, privileged containers, packet-crafting tools, custom network agents, and processes that may open IPPROTO_RAW sockets.
• Apply the latest vendor-supported Linux kernel security update and reboot into the fixed kernel.
• Where feasible, restrict or remove CAP_NET_RAW from containers and services that do not explicitly require it.
• Deploy network detection for ICMP destination-unreachable/fragmentation-needed packets that encapsulate an inner IPv4 header with protocol value 255.
• Review logs and packet captures for signs of repeated suspicious ICMP error traffic before and after patching.
• Treat observed exploitation as a network integrity incident: collect packet captures, route/PMTU state, process capability information, and affected service timelines.