8.2 High

CVE-2026-46037 In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using…

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using icmp_pointers Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES. Avoid consulting icmp_pointers[] for reply types outside that range, and use array_index_nospec() for the remaining in-range lookup. Normal ICMP replies keep their existing behavior unchanged.

Affected products and versions

Product	Affected versions	Fixed in
Linux 7.1	earliest → < 7.1	7.1
Linux 7.0	earliest → < 7.0.4	7.0.4
Linux 6.18	earliest → < 6.18.27	6.18.27
Linux 6.12	earliest → < 6.12.86	6.12.86
Linux 6.6	earliest → < 6.6.140	6.6.140
Linux 6.1	earliest → < 6.1.175	6.1.175
Linux 5.15	earliest → < 5.15.209	5.15.209
Linux	5.13	No fix stated
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated

Show the 3 other branches

Product	Affected versions	Fixed in
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Versions not published