CVE-2026-74550

This CVE exposes a fail-open condition in the Linux kernel's ICMP redirect handling that was introduced through an implicit design assumption rather than an explicit security decision. When inet_peer_xrlim_allow() is called with a valid peer pointer, it enforces rate limiting on redirects. When peer allocation fails under memory pressure and the pointer is NULL, the function returns true—allowing unlimited redirects without any rate limiting. The developers who wrote the error path were likely thinking about silent edge-case handling, not security-critical decision making. The critical insight is that this fail-open occurs precisely when the system is most vulnerable. Memory pressure is the condition under which an attacker can most effectively weaponize redirect amplification. An attacker who can induce transient memory pressure—through separate traffic or system load—triggers unlimited redirect storms to their chosen target. The CVSS 7.5 understates the practical exploitability because the memory pressure prerequisite is trivially achievable by any attacker with network access. The fix is conceptually simple: fail closed by treating peer == NULL as a rate-limit enforcement rather than a bypass. However, this raises an operational question that the patch doesn't fully address: does suppressing redirects under memory pressure cause legitimate routing recovery failures? The original implicit tradeoff—fail-open to preserve routing behavior—may have been reasonable when ICMP redirects were considered a nuisance rather than an amplification vector. That threat model has evolved; the code assumptions haven't. The deeper problem is systemic. This is not an isolated bug—it's one instance of a recurring genotype across kernel subsystems. When resource allocation fails, error paths routinely drop security invariants that the happy path enforces. The conntrack table exhaustion paths, routing cache pressure behaviors, and socket memory limit paths share this genetic signature. The kernel lacks tooling to catch

Reviewed through automated stages and approved by a human before publication.