A load balancer could write off the stack on an error packet
Brief
The commit does not say local privilege escalation.
Notes
e0ba936287dfe9783426aac27e5fd76fe35b38c9 (Kyle Zeng, David Lee / Trail of Bits). Landed via netfilter merge 7b53449540502cb21b32bca62a6258e22cd97bbe on 2026-08-11. Clears IPv4 options after rebasing tunnel ICMP errors. Stale option metadata let the options-echo helper copy into fixed stack storage. Fixes: and Cc: stable. Stack out-of-bounds write. The commit does not say local privilege escalation. Not in 7.1.8.
Commit e0ba936287dfe9783426aac27e5fd76fe35b38c9