Executive brief
The Linux kernel's IP Virtual Server (IPVS) module contains a vulnerability in how it processes ICMP packets embedded within other IP packets. A local attacker can manipulate packet headers to cause the kernel to access memory beyond the bounds of allocated buffer, potentially leading to information disclosure, denial of service, or kernel code execution on systems running vulnerable kernel versions.
Technical details
This is an out-of-bounds memory access vulnerability in the ip_vs_nat_icmp() function of the Linux kernel IPVS module. The vulnerability occurs because the code reads an IP header length (ihl) field from fragmented packet data, then later uses this value without revalidation after the packet has been copied into kernel memory. A local attacker can modify the ihl field to a larger value, causing subsequent checksum operations (ip_send_check()) to read beyond allocated buffer boundaries. The fix adds a validation check that compares the stored ihl value against the expected header length, and drops the packet if a mismatch is detected. No special privileges or network access are required; a local process can trigger this by sending specially crafted packets.
Affected products
- Linux Linux kernel 2.6.12 through approximately 6.10+ (all versions with IPVS before this patch)
Timeline
- 2026-08-26: disclosed: CVE-2026-74747 published
- 2026-08-06: patched: Upstream fix committed by Julian Anastasov
- 2026-08-23: patched: Patch included in stable kernel releases