Executive brief
The Linux kernel's IP Virtual Server (IPVS) component processes ICMP error packets from tunnel networks. A flaw in handling these ICMP errors could allow an attacker to read sensitive memory from the kernel, potentially exposing system information or cryptographic keys used for network operations.
Technical details
The vulnerability is a buffer over-read in the ip_vs_in_icmp() function in net/netfilter/ipvs/ip_vs_core.c. After stripping outer headers with pskb_pull(), the code failed to verify that inner IP headers from tunneled ICMP errors were present in the socket buffer (skb) headroom before accessing them in functions like ipv4_update_pmtu(), icmp_send(), and IP_VS_DBG(). An attacker can craft malformed ICMP packets with insufficient header data to trigger out-of-bounds reads. The fix adds validation checks (cih->version == 4 && cih->ihl >= 5) and pskb_may_pull() calls to ensure headers are properly present in headroom before access. Network reachability is required; no authentication is needed.
Affected products
- Linux Linux kernel all versions; patched in commit 3f7a535ff0fa627a0132803e4c2f903ceffcbc1c
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-07-08: patched: Upstream patch commit 3f7a535ff0fa627a0132803e4c2f903ceffcbc1c merged