CVE-2026-74550

A moderate-impact flaw was found in the Linux kernel networking subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel packages in Red Hat In-Vehicle OS 2. When the kernel fails to allocate an inet peer entry, either under memory pressure or when peer table size limits are reached, the IPv4 and IPv6 redirect handling paths fall back to sending ICMP or NDISC Redirect messages without per-peer rate limiting. Because redirects are not part of the default global ICMP rate limit mask, a remote attacker able to trigger peer allocation failures on a forwarding host could cause an un-rate-limited ICMP/NDISC packet storm, resulting in a denial of service through excessive network traffic and CPU consumption. There is no impact on confidentiality or integrity. Red Hat rates this flaw as Moderate rather than the upstream Important severity, because reliable exploitation requires specific preconditions, such as significant memory pressure or exhausted peer table limits combined with a suitable forwarding topology, which makes the attack difficult to carry out in practice. Fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are deferred to a future update given the moderate impact and the demanding preconditions for exploitation; the residual risk is a network-based denial of service only. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this flaw.