Executive brief
The Linux kernel's IPVS (IP Virtual Server) module handles network load balancing and packet translation. A local attacker could exploit a race condition where the kernel reads packet header fields multiple times, allowing them to write outside validated memory boundaries when processing ICMP responses. This could lead to kernel memory corruption and system instability.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in the IPVS ip_vs_nat_icmp function. The vulnerable code reads the IPv4 IHL (Internet Header Length) field multiple times, and a local attacker can modify the packet between reads to cause out-of-bounds memory writes when processing embedded transport headers in ICMP messages. The fix introduces validation via a pre-calculated `ciph->len` offset instead of recalculating from the potentially-modified IHL field. Attack requires local access to modify packets being processed by IPVS, which is plausible in containerized or shared hosting environments. Patches are available upstream and in stable kernel branches.
Affected products
- Linux Linux kernel All versions from 2.6.12 onwards (fixed in upstream commit 646922a0)
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Fix committed upstream and backported to stable branches