Description

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending un-rate-limited ICMP/NDISC Redirect messages. In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL. In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into inet_peer_xrlim_allow(), which returned true when peer == NULL. Because ICMP/NDISC Redirects are not part of the default global rate limit mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates an un-rate-limited ICMP packet storm. Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and ndisc_send_redirect() when peer is NULL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-15T13:18:00.390Z",
  "pubdate": "2026-08-15T13:18:00.390Z",
  "executiveSummary": "A denial of service vulnerability exists in the networking subsystem of the Linux kernel, specifically within IPv4 and IPv6 redirect handling functions.\nThe vulnerability type is improper handling of resource allocation failures, leading to an un-rate-limited packet storm.\nThe impact of this flaw allows a remote or local entity to trigger excessive network traffic, resulting in network congestion, high CPU utilization, and potential denial of service affecting system availability and network performance.\nAffected systems include Linux kernel instances processing network traffic where inet_getpeer_v4() or inet_getpeer_v6() peer allocations can fail under memory pressure or tree size caps.\nThe risk implications are significant in environments vulnerable to memory exhaustion or artificial resource constraint induction.\nAn attacker can exploit this capability by driving the system into memory pressure or triggering conditions where peer allocation fails, causing the routing and neighbor discovery layers to bypass rate-limiting mechanisms.\nNo specific authentication or specialized privileges are explicitly required beyond the ability to send network packets that trigger redirect generation paths in the affected Linux kernel components.",
  "technicalDetails": "The root cause of the vulnerability lies in the fallback behavior of redirect handlers when the kernel fails to allocate a peer entry via inet_getpeer_v4() or inet_getpeer_v6() due to memory pressure or tree size caps, resulting in a NULL peer pointer.\nIn the IPv4 implementation, ip_rt_send_redirect() directly invokes icmp_send() when the peer pointer resolves to NULL, completely bypassing standard rate-limiting controls.\nIn the IPv6 implementation, ip6_forward() and ndisc_send_redirect() pass a NULL peer into inet_peer_xrlim_allow(), which erroneously evaluates to true when the peer parameter is NULL, defeating the intended rate-limiting enforcement.\nBecause ICMP and NDISC Redirect messages are excluded from the default global rate limit mask governed by sysctl_icmp_ratemask, generating these messages without a valid peer reference creates an un-rate-limited ICMP packet storm.\nThe vulnerable components include the network routing and neighbor discovery subsystems of the Linux kernel, specifically within ip_rt_send_redirect(), ip6_forward(), and ndisc_send_redirect().\nExploitation occurs when an attacker induces or encounters memory pressure states where peer allocation fails while routing packets that necessitate redirection.\nThe attack flow proceeds as follows: 1) The attacker transmits network traffic designed to trigger routing redirects; 2) The Linux kernel attempts to allocate a peer entry using inet_getpeer_v4() or inet_getpeer_v6(), which fails under memory limits; 3) The redirect generation logic encounters a NULL peer instead of properly aborting; 4) The kernel invokes icmp_send() or ndisc_send_redirect() without rate-limiting enforcement; 5) An uncontrolled flood of ICMP or NDISC Redirect packets is transmitted onto the network.\nThe network exposure is broad, affecting any interface processing routable IPv4 or IPv6 traffic capable of generating redirect messages.\nPost-exploitation impact is characterized by network bandwidth exhaustion, exhaustion of interface queue resources, and secondary service degradation across the local network segment."
}